CVE-2015-6940

Published: Sep 22, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.

Affected (10)

Products: Pentaho: Data Integration, Business Analytics

Pentaho

2 products

Data Integration

Business Analytics

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Pentaho Data Integration	Version 4.3
Pentaho Data Integration	Version 4.4
Pentaho Data Integration	Version 5.0
Pentaho Data Integration	Version 5.1
Pentaho Data Integration	Version 5.2

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Pentaho Business Analytics	Version 4.5
Pentaho Business Analytics	Version 4.8
Pentaho Business Analytics	Version 5.0
Pentaho Business Analytics	Version 5.1
Pentaho Business Analytics	Version 5.2