CVEvulnerability
CVE-2015-6940
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-09-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.
Affected configurations
• pentaho data integration 4.3
• pentaho data integration 4.4
• pentaho data integration 5.0
• pentaho data integration 5.1
• pentaho data integration 5.2
• pentaho business analytics 4.5
• pentaho business analytics 4.8
• pentaho business analytics 5.0
• pentaho business analytics 5.1
• pentaho business analytics 5.2
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://packetstormsecurity.com/files/133601/Pentaho-5.2.x-BA-Suite-PDI-Information-Disclosure.html Exploit
- http://www.securityfocus.com/archive/1/536477/100/0/threaded www.securityfocus.com
- https://support.pentaho.com/entries/78884125-Security-Vulnerability-Announcement-Feb-2015 Patch, Vendor Advisory
- http://packetstormsecurity.com/files/133601/Pentaho-5.2.x-BA-Suite-PDI-Information-Disclosure.html Exploit
- http://www.securityfocus.com/archive/1/536477/100/0/threaded www.securityfocus.com
- https://support.pentaho.com/entries/78884125-Security-Vulnerability-Announcement-Feb-2015 Patch, Vendor Advisory