PT-2018-2616 · Sap · Crystal Reports+1

Published 2018-09-11 · Updated 2020-08-24 · CVE-2018-2458

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Business One versions 9.2 and 9.3

Description The issue is related to errors in access restriction in the Crystal Report component of SAP Business One, which can allow an attacker to access restricted information under certain conditions. Exploitation of this issue may enable a remote attacker to gain unauthorized access to protected information.

Recommendations For versions 9.2 and 9.3, consider restricting access to the Crystal Report component until a fix is available. As a temporary workaround, review and tighten access controls and permissions related to the Crystal Report connection type to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-01226

CVE-2018-2458

Affected Products

Crystal Reports

Sap Business One

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-2458 · Security Note
• https://bdu.fstec.ru/vul/2019-01226 · Security Note
• https://launchpad.support.sap.com/#/notes/2670284 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2458 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 · Vendor Advisory
• http://securityfocus.com/bid/105307 · Note
• https://threatpost.ru/sap-patched-14-vulnerabilities-in-its-products/28202 · Note