CVE-2009-5101
Pentaho BI Server < 1.7.0.1062 - Session ID Exposure via URL
Title source: llmDescription
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
References (3)
Core 3
Core References
Exploit x_refsource_misc
http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/
Exploit x_refsource_confirm
http://jira.pentaho.com/browse/BISERVER-3245
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/507168/100/0/threaded
Scores
EPSS
0.0114
EPSS Percentile
62.7%
Details
CWE
CWE-200
Status
published
Products (3)
pentaho/bi_server
1.2.0
pentaho/bi_server
1.6.0
pentaho/bi_server
< 1.7.0.1062
Published
Sep 13, 2011
Tracked Since
Feb 18, 2026