CVE-2019-0303

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.2%
top 54.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Businessobjects Business Intelligence Platform (administration Console)SAP Businessobjects
Timeline
PublishedJun 14
Latest updateMay 24

Description

SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript code when the url is accessed.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDsap/businessobjects4.2, 4.3+1

🔴Vulnerability Details

2
GHSA
GHSA-x8gc-wgw2-28c8: SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4↗2022-05-24
▶
CVEList
CVE-2019-0303: SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4↗2019-06-14
▶
CVE-2019-0303 (MEDIUM CVSS 6.1) | SAP BusinessObjects Business Intell | cvebase.io