PT-2004-1643 · Sap · Sap Business Objects Web Intelligence

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-0533

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Business Objects WebIntelligence versions 2.7.0 through 2.7.4

Description The issue allows remote authenticated users to delete arbitrary files on the server by sending a crafted delete request using the InfoView web client, due to the software only enforcing access controls on the client.

Recommendations For versions 2.7.0 through 2.7.4, consider restricting access to the delete request functionality in the InfoView web client until a patch is available. As a temporary workaround, limit the privileges of authenticated users to prevent them from deleting arbitrary files on the server.

Correção

Identificadores relacionados

CVE-2004-0533

Produtos afetados

Sap Business Objects Web Intelligence

Referências · 6

• http://securityfocus.com/bid/11208 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0056.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17422 · Nota
• http://secunia.com/advisories/12587 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0533 · Nota de Segurança
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026549.html · Aviso do Fabricante