Information disclosure in Pentaho Bi Server

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.

Vulnerability class: Information Disclosure

EPSS: 0.011 (63.2th percentile) — read the EPSS interpretation.

Affected products

Pentaho Bi_server — versions 1.2.0, 1.6.0
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (x_refsource_CONFIRM, Exploit)