PT-2019-5676 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2019-08-13 · Updated 2019-08-19 · CVE-2019-0332

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (Info View) versions 4.1, 4.2, 4.3

Description The issue allows an attacker to inject malicious payload as a keyword in the search function, which is then executed during the search action, resulting in a Cross-Site Scripting (XSS) issue. This is due to inadequate protection of the web page structure, enabling a remote attacker to perform XSS attacks.

Recommendations For versions 4.1, 4.2, 4.3, consider restricting the input for the search function to prevent malicious payload injection until a patch is available. As a temporary workaround, restrict access to the search functionality in the SAP BusinessObjects Business Intelligence Platform to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-04976

CVE-2019-0332

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-0332 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0332 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2742468 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04976 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0332 · Note