Update 1 to Security Note 2735924 – CVE-2019-0352 Improper session management in SAP Business Objects Business Intelligence Platform(CMC), SAP security note 2878555

SAP security note 2878555, "Update 1 to Security Note 2735924 – [CVE-2019-0352] Improper session management in SAP Business Objects Business Intelligence Platform(CMC)", is a program error note released on 12.05.2020. Below are the symptom and SAP recommended solution.

Description

Symptom

In SAP Business Objects Business Intelligence Platform, certain dynamic pages (like JSP) are improperly cached. As a result, even after logging out, an attacker can access sensitive information via the cache and reopen these dynamic pages. This update addresses additional JSP pages that were previously not covered.

Solution

Cache has been disabled on dynamic pages where it was not properly managed. This note provides the complete fix. Customers who previously implemented SAP Note 2735924 should also implement this note to ensure a complete resolution.

This issue is fixed in the patches listed in the "Support Packages & Patches" section below. Relevant patch levels will be added once they are released. For the Business Intelligence Platform maintenance schedule and strategy, refer to SAP Note 2144559.

Reason and prerequisites

Some JSP pages cache the content without proper management.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

• SAP Note 2144559 – BI 4.x Maintenance Strategy & Schedule
• SAP Note 2735924 – [CVE-2019-0352] Improper session management in SAP Business Objects Business Intelligence Platform(CMC)