PT-2011-1349 · Pentaho · Pentaho Bi Server

Published 2011-09-13 · Updated 2018-10-10 · CVE-2009-5100

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pentaho BI Server versions 1.7.0.1062 and earlier

Description The issue allows physically proximate attackers to potentially obtain the password because the autocomplete tag is not set to off on web pages that use a password field.

Recommendations For Pentaho BI Server versions 1.7.0.1062 and earlier, set the autocomplete tag to off on all web pages that contain password fields to prevent potential password exposure.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-5100

Affected Products

Pentaho Bi Server

References · 4

• 🔥 http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel · Exploit
• 🔥 http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-5100 · Security Note
• http://securityfocus.com/archive/1/507168/100/0/threaded · Note