{"vulnerability": "CVE-2021-31600", "sightings": [{"uuid": "1fc5ec37-3895-4167-9ae4-3cd211e4847b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31600", "type": "seen", "source": "https://t.me/cibsecurity/31955", "content": "\u203c CVE-2021-31600 \u203c\n\nAn issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-08T07:28:42.000000Z"}, {"uuid": "072a6ae1-af59-4e55-990d-fc6ecae20efd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31600", "type": "seen", "source": "https://t.me/hacking_Attack/30300", "content": "Exploit Collector\nPentaho Business Analytics / Pentaho Business Server 9.1 User Enumeration\n\nhttps://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png \nPentaho implements a series of web services using the SOAP protocol to allow scripting interaction with the backend server. HAWSEC identified that the services userRoleListService and ServiceAction exposed through the /pentaho/webservices/userRoleListService and /pentaho/ServiceAction?action=SecurityDetails endpoints are not enforcing sufficient access controls. Specifically, an authenticated user can list all application usernames present in the Jackrabbit Repository.\n\nMD5 | 4473d7f48fb807803a782756210b0a90\n\nDownload\nProduct: Pentaho Business Analytics / Pentaho Business Server\nVendor / Manufacturer: Hitachi Vantara\nAffected Version(s): <=\nVulnerability Type: Jackrabbit User Enumeration\nSolution Status: Fix Released on public GitHub repository\nManufacturer Notification:  8th February 2021\nSolution Date: Wont fix\nPublic Disclosure: 01 November 2021\nCVE Reference: CVE-2021-31600\nAuthor(s) of Advisory: Alberto Favero ( HawSec ) & Altion Malka\n\n--- ### --- ### ---\n\nProduct Description:\n\nPentaho is business intelligence (BI) software that provides data\nintegration, OLAP services, reporting, information dashboards, data mining\nand extract, transform, load (ETL) capabilities. Its headquarters are in\nOrlando, Florida. Pentaho was acquired by Hitachi Data Systems in 2015 and\nin 2017 became part of Hitachi Vantara.\n\n( Source: https://en.wikipedia.org/wiki/Pentaho )\n\n--- ### --- ### ---\n\nVulnerability Details:\n\nPentaho implements a series of web services using the SOAP protocol to\nallow scripting interaction with the backend server. HAWSEC identified that\nthe services userRoleListService and ServiceAction exposed through the\n\"/pentaho/webservices/userRoleListService\" and\n\"/pentaho/ServiceAction?action=SecurityDetails\" endpoints are not enforcing\nsufficient access controls. Specifically, an authenticated user can list\nall application usernames present in the Jackrabbit Repository.\n\n--- ### --- ### ---\n\nProof of Concept (PoC):\n\nSee Ginger ( https://github.com/HawSec/ginger )\n\nor\n\n--- ~~~ --- ~~~ ---\nPOST /pentaho/webservices/userRoleListService HTTP/1.1\nHost: localhost:8080\nConnection: close\nCookie: JSESSIONID=878BCFF82EC40D06F72D64172CAC98B4;\nSOAPAction:\nContent-Type: text/xml; charset=UTF-8\nContent-Length: 244\n\nxmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"\nxmlns:ws=\"http://ws.userrole.security.platform.pentaho.org/\">\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:10.628501Z"}, {"uuid": "df60eb0b-68f0-4048-8424-f2856bb76454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31600", "type": "seen", "source": "https://t.me/hacking_Attack/30300", "content": "Exploit Collector\nPentaho Business Analytics / Pentaho Business Server 9.1 User Enumeration\n\nhttps://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png \nPentaho implements a series of web services using the SOAP protocol to allow scripting interaction with the backend server. HAWSEC identified that the services userRoleListService and ServiceAction exposed through the /pentaho/webservices/userRoleListService and /pentaho/ServiceAction?action=SecurityDetails endpoints are not enforcing sufficient access controls. Specifically, an authenticated user can list all application usernames present in the Jackrabbit Repository.\n\nMD5 | 4473d7f48fb807803a782756210b0a90\n\nDownload\nProduct: Pentaho Business Analytics / Pentaho Business Server\nVendor / Manufacturer: Hitachi Vantara\nAffected Version(s): <=\nVulnerability Type: Jackrabbit User Enumeration\nSolution Status: Fix Released on public GitHub repository\nManufacturer Notification:  8th February 2021\nSolution Date: Wont fix\nPublic Disclosure: 01 November 2021\nCVE Reference: CVE-2021-31600\nAuthor(s) of Advisory: Alberto Favero ( HawSec ) & Altion Malka\n\n--- ### --- ### ---\n\nProduct Description:\n\nPentaho is business intelligence (BI) software that provides data\nintegration, OLAP services, reporting, information dashboards, data mining\nand extract, transform, load (ETL) capabilities. Its headquarters are in\nOrlando, Florida. Pentaho was acquired by Hitachi Data Systems in 2015 and\nin 2017 became part of Hitachi Vantara.\n\n( Source: https://en.wikipedia.org/wiki/Pentaho )\n\n--- ### --- ### ---\n\nVulnerability Details:\n\nPentaho implements a series of web services using the SOAP protocol to\nallow scripting interaction with the backend server. HAWSEC identified that\nthe services userRoleListService and ServiceAction exposed through the\n\"/pentaho/webservices/userRoleListService\" and\n\"/pentaho/ServiceAction?action=SecurityDetails\" endpoints are not enforcing\nsufficient access controls. Specifically, an authenticated user can list\nall application usernames present in the Jackrabbit Repository.\n\n--- ### --- ### ---\n\nProof of Concept (PoC):\n\nSee Ginger ( https://github.com/HawSec/ginger )\n\nor\n\n--- ~~~ --- ~~~ ---\nPOST /pentaho/webservices/userRoleListService HTTP/1.1\nHost: localhost:8080\nConnection: close\nCookie: JSESSIONID=878BCFF82EC40D06F72D64172CAC98B4;\nSOAPAction:\nContent-Type: text/xml; charset=UTF-8\nContent-Length: 244\n\nxmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"\nxmlns:ws=\"http://ws.userrole.security.platform.pentaho.org/\">\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:36.879709Z"}, {"uuid": "37f1dcc2-90e3-44d5-aecd-3f1583b78bdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31600", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/30300", "content": "Exploit Collector\nPentaho Business Analytics / Pentaho Business Server 9.1 User Enumeration\n\nhttps://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png \nPentaho implements a series of web services using the SOAP protocol to allow scripting interaction with the backend server. HAWSEC identified that the services userRoleListService and ServiceAction exposed through the /pentaho/webservices/userRoleListService and /pentaho/ServiceAction?action=SecurityDetails endpoints are not enforcing sufficient access controls. Specifically, an authenticated user can list all application usernames present in the Jackrabbit Repository.\n\nMD5 | 4473d7f48fb807803a782756210b0a90\n\nDownload\nProduct: Pentaho Business Analytics / Pentaho Business Server\nVendor / Manufacturer: Hitachi Vantara\nAffected Version(s): <=\nVulnerability Type: Jackrabbit User Enumeration\nSolution Status: Fix Released on public GitHub repository\nManufacturer Notification:  8th February 2021\nSolution Date: Wont fix\nPublic Disclosure: 01 November 2021\nCVE Reference: CVE-2021-31600\nAuthor(s) of Advisory: Alberto Favero ( HawSec ) & Altion Malka\n\n--- ### --- ### ---\n\nProduct Description:\n\nPentaho is business intelligence (BI) software that provides data\nintegration, OLAP services, reporting, information dashboards, data mining\nand extract, transform, load (ETL) capabilities. Its headquarters are in\nOrlando, Florida. Pentaho was acquired by Hitachi Data Systems in 2015 and\nin 2017 became part of Hitachi Vantara.\n\n( Source: https://en.wikipedia.org/wiki/Pentaho )\n\n--- ### --- ### ---\n\nVulnerability Details:\n\nPentaho implements a series of web services using the SOAP protocol to\nallow scripting interaction with the backend server. HAWSEC identified that\nthe services userRoleListService and ServiceAction exposed through the\n\"/pentaho/webservices/userRoleListService\" and\n\"/pentaho/ServiceAction?action=SecurityDetails\" endpoints are not enforcing\nsufficient access controls. Specifically, an authenticated user can list\nall application usernames present in the Jackrabbit Repository.\n\n--- ### --- ### ---\n\nProof of Concept (PoC):\n\nSee Ginger ( https://github.com/HawSec/ginger )\n\nor\n\n--- ~~~ --- ~~~ ---\nPOST /pentaho/webservices/userRoleListService HTTP/1.1\nHost: localhost:8080\nConnection: close\nCookie: JSESSIONID=878BCFF82EC40D06F72D64172CAC98B4;\nSOAPAction:\nContent-Type: text/xml; charset=UTF-8\nContent-Length: 244\n\nxmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"\nxmlns:ws=\"http://ws.userrole.security.platform.pentaho.org/\">\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T06:00:06.047284Z"}, {"uuid": "e474f4b8-0b78-4a75-b390-ffa5d403cc41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31600", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/30300", "content": "Exploit Collector\nPentaho Business Analytics / Pentaho Business Server 9.1 User Enumeration\n\nhttps://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png \nPentaho implements a series of web services using the SOAP protocol to allow scripting interaction with the backend server. HAWSEC identified that the services userRoleListService and ServiceAction exposed through the /pentaho/webservices/userRoleListService and /pentaho/ServiceAction?action=SecurityDetails endpoints are not enforcing sufficient access controls. Specifically, an authenticated user can list all application usernames present in the Jackrabbit Repository.\n\nMD5 | 4473d7f48fb807803a782756210b0a90\n\nDownload\nProduct: Pentaho Business Analytics / Pentaho Business Server\nVendor / Manufacturer: Hitachi Vantara\nAffected Version(s): <=\nVulnerability Type: Jackrabbit User Enumeration\nSolution Status: Fix Released on public GitHub repository\nManufacturer Notification:  8th February 2021\nSolution Date: Wont fix\nPublic Disclosure: 01 November 2021\nCVE Reference: CVE-2021-31600\nAuthor(s) of Advisory: Alberto Favero ( HawSec ) & Altion Malka\n\n--- ### --- ### ---\n\nProduct Description:\n\nPentaho is business intelligence (BI) software that provides data\nintegration, OLAP services, reporting, information dashboards, data mining\nand extract, transform, load (ETL) capabilities. Its headquarters are in\nOrlando, Florida. Pentaho was acquired by Hitachi Data Systems in 2015 and\nin 2017 became part of Hitachi Vantara.\n\n( Source: https://en.wikipedia.org/wiki/Pentaho )\n\n--- ### --- ### ---\n\nVulnerability Details:\n\nPentaho implements a series of web services using the SOAP protocol to\nallow scripting interaction with the backend server. HAWSEC identified that\nthe services userRoleListService and ServiceAction exposed through the\n\"/pentaho/webservices/userRoleListService\" and\n\"/pentaho/ServiceAction?action=SecurityDetails\" endpoints are not enforcing\nsufficient access controls. Specifically, an authenticated user can list\nall application usernames present in the Jackrabbit Repository.\n\n--- ### --- ### ---\n\nProof of Concept (PoC):\n\nSee Ginger ( https://github.com/HawSec/ginger )\n\nor\n\n--- ~~~ --- ~~~ ---\nPOST /pentaho/webservices/userRoleListService HTTP/1.1\nHost: localhost:8080\nConnection: close\nCookie: JSESSIONID=878BCFF82EC40D06F72D64172CAC98B4;\nSOAPAction:\nContent-Type: text/xml; charset=UTF-8\nContent-Length: 244\n\nxmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"\nxmlns:ws=\"http://ws.userrole.security.platform.pentaho.org/\">\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:58.254109Z"}]}