Code injection

2010-10-1817:00:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

75.1%

JSON

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username, which allows remote attackers to enumerate account names via a login SOAPAction to the dswsbobje/services/session URI.

CPENameOperatorVersion
businessobjectseq3.2 enterprise-xi

CPE	Name	Operator	Version
	businessobjects	eq	3.2 enterprise-xi

References

spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf