Lucene search

SapCVE-2018-2483

HistoryNov 13, 2018 - 8:29 p.m.

CVE-2018-2483

2018-11-1320:29:00

CWE-287

sap

web.nvd.nist.gov

nvd

cve-2018-2483

sap

businessobjects

platform

security

http verb tampering

cmc

central management console

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

33.1%

JSON

HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC) by changing request method.

Affected configurations

Nvd

Node

sapbusinessobjects_business_intelligenceMatch4.1

sapbusinessobjects_business_intelligenceMatch4.2

VendorProductVersionCPE
sapbusinessobjects_business_intelligence4.1cpe:2.3:a:sap:businessobjects_business_intelligence:4.1:*:*:*:*:*:*:*
sapbusinessobjects_business_intelligence4.2cpe:2.3:a:sap:businessobjects_business_intelligence:4.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	businessobjects_business_intelligence	4.1	cpe:2.3:a:sap:businessobjects_business_intelligence:4.1:::::::*
sap	businessobjects_business_intelligence	4.2	cpe:2.3:a:sap:businessobjects_business_intelligence:4.2:::::::*

CNA Affected

[
  {
    "product": "SAP BusinessObjects Business Intelligence Platform",
    "vendor": "SAP",
    "versions": [
      {
        "status": "affected",
        "version": "= 4.1"
      },
      {
        "status": "affected",
        "version": "= 4.2"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105899

launchpad.support.sap.com/#/notes/2647714

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

33.1%

JSON

Related for CVE-2018-2483