Vulnerabilities

TI-2009-04853 CVE-2009-5101 · GHSA-78rm-x38x-8fwp

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL…

LOW 25

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01135 Published 2011-09-13 No fix listed CWE-200

TI-2009-04852 CVE-2009-5100 · GHSA-88m9-g755-gjf2

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web…

LOW 11

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00409 Published 2011-09-13 No fix listed CWE-200

TI-2009-04851 CVE-2009-5099 · GHSA-jh75-h74m-97h7

Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062…

LOW 22

Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01128 Published 2011-09-13 No fix listed CWE-79

Vulnerabilities

Filters

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL…

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web…

Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062…