Description
The SAP Business Objects Enterprise Java Web Portal can be abused by a malicious user allowing them to obtain authentication information from other legitimate users.
In addition, the product can be used to aid in phishing attacks by allowing a malicious user to publish a URL purporting to be from the SAP Business Objects Enterprise Java Web Portal, only to redirect the user to a URL of their own choosing.
The affected release is SAP Business Objects Enterprise Java Web Portal (release XIR2, XIR3 and XIR3.1). More detailed information about affected releases can be found in the section “Reason and Prerequisites”.
Available fix and Supported packages
Affected component
- BI-BIP-ADM
BI Servers, security, Crystal Reports in Launchpad
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1420608
