PT-2018-15566 · Sap · Sap Businessobjects Business Intelligence

Published 2018-08-14 · Updated 2018-10-11 · CVE-2018-2442

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence versions 4.0 through 4.2

Description The issue allows user session details to be captured by an HTTP analysis tool and reused in an HTML page while the user session is still valid, potentially leading to unauthorized access. This occurs when viewing a Web Intelligence report from BI Launchpad.

Recommendations For versions 4.0 through 4.2, consider restricting access to sensitive reports and implementing additional session validation to minimize the risk of exploitation. As a temporary workaround, restrict the use of HTTP analysis tools to prevent session details from being captured.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-2442

Affected Products

Sap Businessobjects Business Intelligence

References · 5

• https://osv.dev/vulnerability/CVE-2018-2442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2442 · Security Note
• https://launchpad.support.sap.com/#/notes/2407193 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742 · Vendor Advisory
• http://securityfocus.com/bid/105078 · Note