PT-2019-5657 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2019-08-13 · Updated 2019-08-22 · CVE-2019-0334

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (BI Workspace) versions 4.1 through 4.3

Description The issue allows a malicious script to be stored in a module, potentially enabling a user to escalate privileges via session hijacking when the script is executed later. This could also lead to access of other sensitive information due to Stored Cross Site Scripting. The vulnerability exists due to inadequate protection of the web page structure, which may allow a remote attacker to elevate privileges or disclose protected information.

Recommendations For versions 4.1 through 4.3, consider disabling the module creation feature in BI Workspace until a patch is available to prevent the storage and execution of malicious scripts. Restrict access to sensitive information and monitor user sessions for potential hijacking attempts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-04841

CVE-2019-0334

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-0334 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0334 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04841 · Security Note
• https://launchpad.support.sap.com/#/notes/2771221 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0334 · Note
• https://authn.hana.ondemand.com/saml2/sp/mds · Note