CVE-2009-5101
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pentaho:bi_server
References
- http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/
- http://jira.pentaho.com/browse/BISERVER-3245
- http://www.securityfocus.com/archive/1/507168/100/0/threaded
- http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/
- http://jira.pentaho.com/browse/BISERVER-3245