CVE-2021-31600

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames.

• CWE-552

• http://packetstormsecurity.com/files/164787/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-User-Enumeration.htmlExploit, Third Party Advisory, VDB Entry
• https://www.hitachi.com/hirt/security/index.htmlVendor Advisory
• http://packetstormsecurity.com/files/164787/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-User-Enumeration.htmlExploit, Third Party Advisory, VDB Entry
• https://www.hitachi.com/hirt/security/index.htmlVendor Advisory

Published

Nov 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3159A stored cross site scripting (XSS) vulnerability in the /sy…5.4
• CVE-2021-31590PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect J…8.8
• CVE-2021-31597The xmlhttprequest-ssl package before 1.6.1 for Node.js disa…9.4
• CVE-2021-31598An issue was discovered in libezxml.a in ezXML 0.8.6. The fu…7.5
• CVE-2021-31599An issue was discovered in Hitachi Vantara Pentaho through 9…8.8
• CVE-2021-3160Deserialization of untrusted data in the login page of ASSUW…9.8
• CVE-2021-31601An issue was discovered in Hitachi Vantara Pentaho through 9…6.5
• CVE-2021-31602An issue was discovered in Hitachi Vantara Pentaho through 9…7.5
• CVE-2021-31604furlongm openvpn-monitor through 1.1.3 allows CSRF to discon…6.5
• CVE-2021-31605furlongm openvpn-monitor through 1.1.3 allows %0a command in…7.5
• CVE-2021-31606furlongm openvpn-monitor through 1.1.3 allows Authorization …7.5
• CVE-2021-31607In SaltStack Salt 2016.9 through 3002.6, a command injection…7.8