CVE-2022-4815

Published: May 24, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.

Affected (3)

Products: Hitachi: Vantara Pentaho, Vantara Pentaho Business Analytics Server

Hitachi

2 products

Vantara Pentaho

Vantara Pentaho Business Analytics Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Hitachi Vantara Pentaho	From 8.3.0.0 to 8.3.0.25
Hitachi Vantara Pentaho Business Analytics Server	From 9.3.0.0 to 9.3.0.3
Hitachi Vantara Pentaho Business Analytics Server	Version 9.4.0.0

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://support.pentaho.com/hc/en-us/articles/14455879270285-IMPORTANT-Resolved-Pentaho-BA-Server-Deserialization-of-Untrusted-Data-Versions-before-9-4-0-1-and-9-3-0-3-including-8-3-x-Impacted-CVE-2022-4815-

Source: security.vulnerabilities@hitachivantara.com

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.