CVE-2018-2479

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

6.1MEDIUM

EPSS

0.4%

top 41.22%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SAP SAP Businessobjects Business Intelligence Platform (biworkspace)SAP Businessobjects BI Platform

Timeline

PublishedNov 13

Latest updateMay 14

Description

SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5sap/sap_businessobjects_business_intelligence_platform_(biworkspace)= 4.1, = 4.2+1

▶NVDsap/businessobjects_bi_platform4.1, 4.2+1

🔴Vulnerability Details

GHSA

GHSA-pr64-j6cq-j9jh: SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4↗2022-05-14

▶

CVEList

CVE-2018-2479: SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4↗2018-11-13

▶