CVE

Id
84217  
CVE No.
CVE-2015-6940  
Status
Candidate  
Description
The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.  
Phase
Assigned (20150915)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
746694 84217 CVE-2015-6940 BUGTRAQ:20150916 Fwd: [CVE-2015-6940] Pentaho GA PDI & GA BA - Improper authentication allows unauthenticated access to configuration files  View
746695 84217 CVE-2015-6940 URL:http://www.securityfocus.com/archive/1/archive/1/536477/100/0/threaded  View
746696 84217 CVE-2015-6940 MISC:http://packetstormsecurity.com/files/133601/Pentaho-5.2.x-BA-Suite-PDI-Information-Disclosure.html  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
10209 JVNDB-2015-005529 複数の Apple 製品の CoreText における任意のコードを実行される脆弱性 Apple iOS、OS X、および iTunes の CoreText には、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態にされる脆弱性が存在します。 CVE-2015-6992 84217 7.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005529.html  View