CVE-2019-0334 — Cross-site Scripting in SE SAP Businessobjects Business Intelligence Platform

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 55.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Businessobjects Business Intelligence PlatformSAP Businessobjects Business Intelligence
Timeline
PublishedAug 14
Latest updateMay 24

Description

When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-7q7c-hqqv-v8x5: When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4↗2022-05-24
▶
CVEList
CVE-2019-0334: When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4↗2019-08-14
▶
CVE-2019-0334 — Cross-site Scripting | cvebase