CVE-2010-3979

2022-10-0316:20:56

mitre

www.cve.org

cve-2010-3979

sap businessobjects

remote attackers

6.6 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

75.1%

JSON

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username, which allows remote attackers to enumerate account names via a login SOAPAction to the dswsbobje/services/session URI.

References

spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf