Description

Acunetix determined that it was possible to access Pentaho API without authentication with a specially crafted HTTP request.

Remediation

Upgrade to the latest version of Pentaho

References

Pentaho Authentication Bypass

Related Vulnerabilities

PHP open_basedir Is Not Configured

ASP.NET WCF service include exception details

WordPress admin accessible without HTTP authentication

Static Nonce Identified in Content Security Policy (CSP)

The Heartbleed Bug

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration CWE-863 CVE-2021-31602