CVE-2021-31601

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Nov 8, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-316027.5An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has CVE-2021-316046.5furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client.CVE-2021-316057.5furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the servCVE-2021-316067.5furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.CVE-2021-316077.8In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escaCVE-2021-316084.3Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.CVE-2021-316096.5The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packCVE-2021-316106.5The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, alloCVE-2021-316115.7The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure CVE-2021-316126.5The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greateCVE-2021-316136.5The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP pacCVE-2021-316155.3Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent device to inject a c
CVE-2021-31601: Medium severity, CVSS 6.5 | Vulnix