Code injection

2010-10-1817:00:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

57.2%

JSON

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause a denial of service via a large numCuids value in a GenerateCuids SOAPAction to the dswsbobje/services/biplatform URI.

CPENameOperatorVersion
businessobjectseq3.2 enterprise-xi

CPE	Name	Operator	Version
	businessobjects	eq	3.2 enterprise-xi

References

spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf