PT-2018-15566 · Sap · Sap Businessobjects Business Intelligence

Publicado 2018-08-14 · Atualizado 2018-10-11 · CVE-2018-2442

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence versions 4.0 through 4.2

Description The issue allows user session details to be captured by an HTTP analysis tool and reused in an HTML page while the user session is still valid, potentially leading to unauthorized access. This occurs when viewing a Web Intelligence report from BI Launchpad.

Recommendations For versions 4.0 through 4.2, consider restricting access to sensitive reports and implementing additional session validation to minimize the risk of exploitation. As a temporary workaround, restrict the use of HTTP analysis tools to prevent session details from being captured.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-2442

Produtos afetados

Sap Businessobjects Business Intelligence

Referências · 5

• http://securityfocus.com/bid/105078 · Nota
• https://osv.dev/vulnerability/CVE-2018-2442 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2442 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2407193 · Aviso do Fabricante
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742 · Aviso do Fabricante