Medium severity · published Jul 10, 2018
CVE-2018-2432
SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP…
5.4
CVSS
1%
EPSS
No
On KEV
Description
SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
Businessobjects Business Intelligence · Sap
4.1; 4.2; 4.3 · source: NVD
Affected product
BB
Businessobjects Business Intelligence
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-2432
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-2432
Third Party Advisory
http://www.securityfocus.com/bid/104716
Permissions Required
https://launchpad.support.sap.com/#/notes/2523290
Patch
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
More from Businessobjects Business Intelligence
9.9
CVE-2023-40622
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
9.8
CVE-2023-28765
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
9.6
CVE-2018-2445
AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the…
9.0
CVE-2023-37490
Binary hijack in SAP BusinessObjects Business Intelligence (Installer)
8.8
CVE-2022-41203
In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object…