Medium severity · published Aug 14, 2019
CVE-2019-0331
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory…
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
Businessobjects Business Intelligence · Sap
4.1; 4.2; 4.3 · source: NVD
Affected product
BB
Businessobjects Business Intelligence
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0331
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0331
Permissions Required
https://launchpad.support.sap.com/#/notes/2742468
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
More from Businessobjects Business Intelligence
9.9
CVE-2023-40622
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
9.8
CVE-2023-28765
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further…
9.6
CVE-2018-2445
AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the…
9.0
CVE-2023-37490
Binary hijack in SAP BusinessObjects Business Intelligence (Installer)
8.8
CVE-2022-41203
In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object…