Cross site scripting

2019-10-0820:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

22.0%

JSON

SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting

CPENameOperatorVersion
businessobjects_business_intelligence_platformeq4.2 sp4
businessobjects_business_intelligence_platformeq4.2 sp5
businessobjects_business_intelligence_platformeq4.2 sp6
businessobjects_business_intelligence_platformeq4.2 sp7
businessobjects_business_intelligence_platformeq4.0
businessobjects_business_intelligence_platformeq4.1 sp12
businessobjects_business_intelligence_platformeq4.1 sp11
businessobjects_business_intelligence_platformeq4.1 sp10
businessobjects_business_intelligence_platformeq4.1

Name	Operator	Version
businessobjects_business_intelligence_platform	eq	4.2 sp4
businessobjects_business_intelligence_platform	eq	4.2 sp5
businessobjects_business_intelligence_platform	eq	4.2 sp6
businessobjects_business_intelligence_platform	eq	4.2 sp7
businessobjects_business_intelligence_platform	eq	4.0
businessobjects_business_intelligence_platform	eq	4.1 sp12
businessobjects_business_intelligence_platform	eq	4.1 sp11
businessobjects_business_intelligence_platform	eq	4.1 sp10
businessobjects_business_intelligence_platform	eq	4.1

References

launchpad.support.sap.com/

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050

0.001 Low

EPSS

Percentile

22.0%

JSON

Related for PRION:CVE-2019-0374