PT-2021-8379 · Sap · Sap Businessobjects Edge

Published 2021-08-09 · Updated 2021-08-17 · CVE-2014-9320

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Edge version 4.1

Description The issue allows remote attackers to obtain the SI PLATFORM SEARCH SERVER LOGON TOKEN token, which can lead to gaining SYSTEM privileges. This is achieved through vectors involving CORBA calls.

Recommendations For SAP BusinessObjects Edge version 4.1, apply the fix as described in SAP Note 2039905 to resolve the issue. As a temporary workaround, consider restricting access to CORBA calls to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-9320

Affected Products

Sap Businessobjects Edge

References · 7

• http://seclists.org/fulldisclosure/2014/Dec/60 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-9320 · Security Note
• https://securityfocus.com/archive/1/archive/1/534249/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99607 · Note
• https://onapsis.com/research/security-advisories/sap-business-objects-search-token-privilege-escalation-via-corba · Note
• https://t.me/cvenotify/18942 · Telegram Post
• http://packetstormsecurity.com/files/129613/SAP-Business-Objects-Search-Token-Privilege-Escalation.html · Note