CVE-2018-2432
published 2018-07-10CVE-2018-2432: SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated…
PriorityP424medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.74%
50.4th percentile
SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | businessobjects_business_intelligence | — | — |
| sap | businessobjects_business_intelligence | — | — |
| sap | businessobjects_business_intelligence | — | — |
| sap | sap_businessobjects_business_intelligence | — | — |
| sap | sap_businessobjects_business_intelligence | — | — |
| sap | sap_businessobjects_business_intelligence | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/104716https://launchpad.support.sap.com/#/notes/2523290https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000http://www.securityfocus.com/bid/104716https://launchpad.support.sap.com/#/notes/2523290https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
2018-07-10
Published