CVE-2022-4771

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Hitachi Vantara	Pentaho Business Analytics Server	>= 1.0, < 9.3.0.2; >= 9.4.0.0, < 9.4.0.1

References

Timeline

Published: Apr 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-477149.8Last Yard 22.09.8-1 does not enforce HSTS headers CVE-2022-477155.3In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.CVE-2022-477177.5Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).CVE-2022-47727.8A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/wid CVE-2022-47733.3** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the func CVE-2022-477327.5In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing ad CVE-2022-47749.8The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated CVE-2022-477409.8Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.CVE-2022-477458.8ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a s CVE-2022-477477.5kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.CVE-2022-47755.4The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2022-477579.8In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into