PT-2019-4582 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2019-06-14 · Updated 2019-06-18 · CVE-2019-0303

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform versions 4.2, 4.3

Description The issue exists due to the lack of neutralization of special elements in the BILogon/appService.jsp module. This could allow a remote attacker to execute arbitrary code. The module reflects the requested parameter errMsg into response content without proper sanitation, potentially enabling an attacker to build a special URL that executes custom JavaScript code when accessed.

Recommendations For versions 4.2 and 4.3, consider disabling the BILogon/appService.jsp module until a patch is available to prevent potential exploitation. Restrict access to the module to minimize the risk of arbitrary code execution. Avoid using the errMsg parameter in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00642

CVE-2019-0303

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-0303 · Security Note
• https://bdu.fstec.ru/vul/2020-00642 · Security Note
• https://launchpad.support.sap.com/#/notes/2637997 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0303 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 · Vendor Advisory
• https://threatpost.ru/sap-published-june-patch-notes/33079 · Note