Strix
26.1K

CVE-2015-6940

UnknownEPSS 2.30%

Last modified

CVE-2015-6940 is a vulnerability of currently unknown severity. The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.. EPSS estimates a 2.30% chance of exploitation in the next 30 days.

Description

The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.

Metrics

EPSS Probability
2.30%

81.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
PentahoData Integration4.3
PentahoData Integration4.4
PentahoData Integration5.0
PentahoData Integration5.1
PentahoData Integration5.2
PentahoBusiness Analytics4.5
PentahoBusiness Analytics4.8
PentahoBusiness Analytics5.0
PentahoBusiness Analytics5.1
PentahoBusiness Analytics5.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2015-6940?
The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.
How severe is CVE-2015-6940?
Severity scoring for CVE-2015-6940 is pending analysis. The EPSS model estimates a 2.30% probability of exploitation in the next 30 days.
How do I fix CVE-2015-6940?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-6940?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST