CVE-2015-6940 - CVE House
Back to Database
Status published Medium CVE-2015-6940

The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x,...

Vulnerability Description

The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-6940

Credits & Attribution

No credits recorded in the NVD database.

References

More from pentaho

View All →
CVE-2009-5101
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID...
Medium 5
CVE-2009-5100
Pentaho BI Server 1.7.0.1062 and earlier does not set the...
Low 2.1
CVE-2009-5099
Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server...
Medium 4.3
CVE-2006-5675
Multiple unspecified vulnerabilities in Pentaho Business Intelligence (BI) Suite before...
Critical 10

Affected Vendor

Affected Software

data integration, business analytics
Vulnerable Versions:
4.3, 4.4, 5.0, 5.1, 5.2, 4.5, 4.8

Timeline

Official Publish: September 22nd, 2015
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.