PT-2019-4447 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2019-08-13 · Updated 2020-08-24 · CVE-2019-0333

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (Web Intelligence) versions 4.2, 4.3

Description The issue is related to a lack of protection for internal data in the Web Intelligence component of the SAP BusinessObjects Business Intelligence platform. In certain situations, when a client cancels a query, an attacker can then query and receive the entire data set, instead of just the data that is part of their authorized security profile, resulting in information disclosure. This can allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions 4.2 and 4.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-00234

CVE-2019-0333

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 6

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0333 · Security Note
• https://bdu.fstec.ru/vul/2020-00234 · Security Note
• https://launchpad.support.sap.com/#/notes/2764513 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0333 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0333 · Note