PT-2015-7416 · Pentaho · Pentaho Business Analytics Suite+1

Publicado 2015-09-22 · Atualizado 2018-10-09 · CVE-2015-6940

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pentaho Business Analytics (BA) Suite versions 4.5.x through 5.2.x Pentaho Data Integration (PDI) Suite versions 4.3.x through 5.2.x

Description The issue concerns the GetResource servlet, which fails to restrict access to files in the pentaho-solutions/system folder. This allows remote attackers to obtain sensitive information, including passwords, by specifying a file name in the resource parameter.

Recommendations For Pentaho Business Analytics (BA) Suite versions 4.5.x through 5.2.x, restrict access to the GetResource servlet to prevent unauthorized file access. For Pentaho Data Integration (PDI) Suite versions 4.3.x through 5.2.x, limit access to the GetResource servlet to minimize the risk of sensitive information disclosure. As a temporary workaround, consider restricting access to the pentaho-solutions/system folder until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-6940

Produtos afetados

Pentaho Business Analytics Suite

Pentaho Data Integration Suite

Referências · 4

• 🔥 http://packetstormsecurity.com/files/133601/Pentaho-5.2.x-BA-Suite-PDI-Information-Disclosure.html · Exploit
• https://support.pentaho.com/entries/78884125-Security-Vulnerability-Announcement-Feb-2015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6940 · Nota de Segurança
• http://securityfocus.com/archive/1/536477/100/0/threaded · Nota