CVE-2009-5101: Infoleak
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5101?
CVE-2009-5101 has a severity rating of medium due to the exposure of sensitive session information.
How can CVE-2009-5101 be mitigated?
To mitigate CVE-2009-5101, users should avoid including session IDs in URLs and implement secure cookie settings.
Which versions are affected by CVE-2009-5101?
CVE-2009-5101 affects Pentaho BI Server versions up to and including 1.7.0.1062 and specific older versions like 1.2.0 and 1.6.0.
What kind of attack can exploit CVE-2009-5101?
CVE-2009-5101 can be exploited through session hijacking, allowing attackers to capture session IDs via sniffing or referer headers.
Is there a patch available for CVE-2009-5101?
Yes, patches or upgrades should be applied to later versions of Pentaho BI Server to address CVE-2009-5101.