CVE-2021-31600

MEDIUM Year: 2021
CVSS v3 Score
4.3
Medium
CVSS v2 Score
4.0
Medium
Weakness Type
CWE-552
View all →

Vulnerability Description

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames.

Related Vulnerabilities

CVE-2017-1602

MEDIUM
CVSS:4.3(Medium)

IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force...

CWE-5522017

CVE-2019-17112

MEDIUM
CVSS:4.3(Medium)

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (...

CWE-5522019

CVE-2021-20148

MEDIUM
CVSS:4.3(Medium)

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured...

CWE-5522021

CVE-2021-22769

MEDIUM
CVSS:4.3(Medium)

A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.1 and older that could expose files or directory content when access from an atta...

CWE-5522021

CVE-2021-34765

MEDIUM
CVSS:4.3(Medium)

A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application. The attacker requires valid device crede...

CWE-5522021

CVE-2021-3856

MEDIUM
CVSS:4.3(Medium)

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an exte...

CWE-5522021