Pentaho Business Analytics Server - Authorization Bypass (CVE-2022-43939)

CVE-2022-43939 is a vulnerability in Hitachi Vantara Pentaho Business Analytics Server which allows attackers to bypass security restrictions through specifically crafted URLs using non-canonical forms.

CrowdSec has been tracking this vulnerability and its exploits since 17th of March 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2022-43939 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-43939 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-43939 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts generally focus on requests to URLs containing both /pentaho/api/ldap/config/ldaptreenodechildren and /require.