CVE-2009-5101

EUVD-2009-5056
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
Affected Products (NVD)
VendorProductVersion
pentahobi_server
𝑥
≤ 1.7.0.1062
pentahobi_server
1.2.0
pentahobi_server
1.6.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/
http://jira.pentaho.com/browse/BISERVER-3245
http://www.securityfocus.com/archive/1/507168/100/0/threaded
http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/
http://jira.pentaho.com/browse/BISERVER-3245
http://www.securityfocus.com/archive/1/507168/100/0/threaded