CVE-2021-31602

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.

• CWE-287

• http://packetstormsecurity.com/files/164784/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• https://www.hitachi.com/hirt/security/index.htmlVendor Advisory
• http://packetstormsecurity.com/files/164784/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• https://www.hitachi.com/hirt/security/index.htmlVendor Advisory

Published

Nov 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31597The xmlhttprequest-ssl package before 1.6.1 for Node.js disa…9.4
• CVE-2021-31598An issue was discovered in libezxml.a in ezXML 0.8.6. The fu…7.5
• CVE-2021-31599An issue was discovered in Hitachi Vantara Pentaho through 9…8.8
• CVE-2021-3160Deserialization of untrusted data in the login page of ASSUW…9.8
• CVE-2021-31600An issue was discovered in Hitachi Vantara Pentaho through 9…4.3
• CVE-2021-31601An issue was discovered in Hitachi Vantara Pentaho through 9…6.5
• CVE-2021-31604furlongm openvpn-monitor through 1.1.3 allows CSRF to discon…6.5
• CVE-2021-31605furlongm openvpn-monitor through 1.1.3 allows %0a command in…7.5
• CVE-2021-31606furlongm openvpn-monitor through 1.1.3 allows Authorization …7.5
• CVE-2021-31607In SaltStack Salt 2016.9 through 3002.6, a command injection…7.8
• CVE-2021-31608Proofpoint Enterprise Protection before 18.8.0 allows a Bypa…4.3
• CVE-2021-31609The Bluetooth Classic implementation in Silicon Labs iWRAP 6…6.5