CVE-2019-0346: Cleartext Transmission of Sensitive Information

Unencrypted communication error in SAP Business Objects Business Intelligence Platform Central Management Console, version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure...

CVE-2019-0331: Undefined Security Weakness

Under certain conditions, SAP BusinessObjects Business Intelligence Platform BI Workspace, versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure...

CVE-2019-0335: Improper Neutralization of Input During Web Page Generation

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console, versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the...

CVE-2019-0334: Improper Neutralization of Input During Web Page Generation

When creating a module in SAP BusinessObjects Business Intelligence Platform BI Workspace, versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other...

PT-2019-5675

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform BI Workspace versions 4.1, 4.2, 4.3 Description The issue allows an attacker to access sensitive data, such as directory structure, leading to information disclosure. This is due to a lack of...

PT-2019-5676

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Info View versions 4.1, 4.2, 4.3 Description The issue allows an attacker to inject malicious payload as a keyword in the search function, which is then executed during the search action,...

PT-2019-4447

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence versions 4.2, 4.3 Description The issue is related to a lack of protection for internal data in the Web Intelligence component of the SAP BusinessObjects Business Intelligence...

PT-2019-4450

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform Central Management Console version 4.2 Description The issue is related to an unencrypted communication error, which leads to the disclosure of a list of user names and roles imported from SA...

PT-2019-5657

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform BI Workspace versions 4.1 through 4.3 Description The issue allows a malicious script to be stored in a module, potentially enabling a user to escalate privileges via session hijacking when th...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2019-25982)

SAP BusinessObjects Business Intelligence Platform is a suite of bookstore intelligence software and enterprise performance solutions from Germany's SAP. The product features report generation, analytics and data visualization. A cross-site scripting vulnerability exists in SAP BusinessObjects...

CVE-2019-0326: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform BI Workspace Enterprise, versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

PT-2019-4587

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform BI Workspace Enterprise versions 4.1, 4.2, 4.3 Description The issue exists due to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS issue. This could...

Code injection

SAP BusinessObjects Business Intelligence Platform Administration Console, versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript co...

CVE-2019-0303: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform Administration Console, versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript co...

PT-2019-4582

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform versions 4.2, 4.3 Description The issue exists due to the lack of neutralization of special elements in the BILogon/appService.jsp module. This could allow a remote attacker to execute arbitra...

PT-2019-11220

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence platform Analysis for OLAP versions 4.2 and 4.3 Description: The issue allows an attacker to access restricted information under certain conditions. Recommendations: For versions 4.2 and 4.3, at the...

PT-2019-11219

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence platform Central Management Server versions 4.2 and 4.3 Description: The issue allows an attacker to access restricted information under certain conditions. Recommendations: For versions 4.2 and 4.3, ...

CVE-2019-0287: Undefined Security Weakness

Under certain conditions SAP BusinessObjects Business Intelligence platform Central Management Server, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

CVE-2019-0289: Undefined Security Weakness

Under certain conditions SAP BusinessObjects Business Intelligence platform Analysis for OLAP, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

Partner Perspectives: Stay Proactive with Automated Threat Blocking from Carbon Black and IntSights

Alon Yotvat is a Senior Solutions Architect for IntSights. Carbon Black and IntSights have joined forces to combine next-gen endpoint security solutions with powerful external threat intelligence. This potent integration of cybersecurity technologies gives enterprises the protection they need to...