Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

CVE-2018-2432 Header Manipulation vulnerability in BI LaunchPad and CMC, SAP security note 2523290

SAP Note 2523290
SAP Security Note
Medium priority

SAP security note 2523290, "[CVE-2018-2432] Header Manipulation vulnerability in BI LaunchPad and CMC", is a program error note released on July 10, 2018. Below are the symptom and SAP recommended solution.

ComponentBusiness intelligence solutions > Business intelligence platform > InfoView, BI launch pad
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version6
StatusReleased for Customer
Released onJuly 10, 2018
LanguageEnglish

Description

Symptom

BI LaunchPad and CMC allows an attacker to include unvalidated data in the HTTP response header sent to a Web user.

Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking.

Solution

This issue is fixed in the patches listed in the "Support Packages & Patches" section below.

For Business Intelligence Platform maintenance schedule and strategy, see the Knowledge Base Article 2144559 in the References section.

CVSS

Score 4.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Full note on SAP: SAP Support Launchpad note 2523290

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#HTTP response splitting #HTTP header manipulation #parameter manipulation #CVE-2018-2432

Explore More