PT-2015-7416 · Pentaho · Pentaho Business Analytics Suite+1

Published 2015-09-22 · Updated 2018-10-09 · CVE-2015-6940

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pentaho Business Analytics (BA) Suite versions 4.5.x through 5.2.x Pentaho Data Integration (PDI) Suite versions 4.3.x through 5.2.x

Description The issue concerns the GetResource servlet, which fails to restrict access to files in the pentaho-solutions/system folder. This allows remote attackers to obtain sensitive information, including passwords, by specifying a file name in the resource parameter.

Recommendations For Pentaho Business Analytics (BA) Suite versions 4.5.x through 5.2.x, restrict access to the GetResource servlet to prevent unauthorized file access. For Pentaho Data Integration (PDI) Suite versions 4.3.x through 5.2.x, limit access to the GetResource servlet to minimize the risk of sensitive information disclosure. As a temporary workaround, consider restricting access to the pentaho-solutions/system folder until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-6940

Affected Products

Pentaho Business Analytics Suite

Pentaho Data Integration Suite

References · 4

• 🔥 http://packetstormsecurity.com/files/133601/Pentaho-5.2.x-BA-Suite-PDI-Information-Disclosure.html · Exploit
• https://support.pentaho.com/entries/78884125-Security-Vulnerability-Announcement-Feb-2015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6940 · Security Note
• http://securityfocus.com/archive/1/536477/100/0/threaded · Note