CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
VendorProductVersion
pentahobi_server
𝑥
≤ 1.7.0.1062
pentahobi_server
1.2.0
pentahobi_server
1.6.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/
http://jira.pentaho.com/browse/BISERVER-3245
http://www.securityfocus.com/archive/1/507168/100/0/threaded
http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/
http://jira.pentaho.com/browse/BISERVER-3245
http://www.securityfocus.com/archive/1/507168/100/0/threaded