« Volver al listado

CVE-2009-5100

Estado: ModificadaBaja (2.1)—

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pentaho — BI Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-5100",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-09-13T19:59:26.080",
  "references": [
    {
      "url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password."
    },
    {
      "lang": "es",
      "value": "Pentaho BI Server v1.7.0.1062 y anteriores no pone la etiqueta de autocompletado en las páginas web usando un campo de contraseña, lo que podría permitir obtener la contraseña a atacantes físicamente próximos ."
    }
  ],
  "lastModified": "2026-06-16T23:15:01.070",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pentaho:bi_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "605FB01C-95A9-4B46-A48A-CBCBE04FFDFA",
              "versionEndIncluding": "1.7.0.1062"
            },
            {
              "criteria": "cpe:2.3:a:pentaho:bi_server:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABE602CD-9D31-4053-BAE8-078054A16A07"
            },
            {
              "criteria": "cpe:2.3:a:pentaho:bi_server:1.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59EC974C-6F5C-4DCB-873B-F62990E1297E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}