Headline

Pentaho Business Analytics / Pentaho Business Server 9.1 Insufficient Access Control

Pentaho implements a series of web services using the SOAP protocol to allow scripting interaction with the backend server. While most of the interfaces correctly implement ACL, the Data Source Management Service located at /pentaho/webservices/datasourceMgmtService allows low-privilege authenticated users to list the connection details of all data sources used by Pentaho.

3 years ago

Packet Storm

Open in Source

#sql #web #vulnerability #red_hat #web #vulnerability #vulnerability #red_hat #vulnerability #vulnerability #vulnerability #vulnerability #vulnerability #web

Pentaho implements a series of web services using the SOAP protocol to allow scripting interaction with the backend server. HAWSEC identified that the services userRoleListService and ServiceAction exposed through the /pentaho/webservices/userRoleListService and /pentaho/ServiceAction?action=SecurityDetails endpoints are not enforcing sufficient access controls. Specifically, an authenticated user can list all application usernames present in the Jackrabbit Repository.

3 years ago

Packet Storm

Open in Source

#sql #web #vulnerability #red_hat #web