SAP Security Note
Medium priority
SAP security note 2283666, “Potential information disclosure in Business Objects Explorer”, is a program error note released on 13.12.2016. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can discover information relating to Business Objects Explorer user details for BI LaunchPad and Central Management Console. This information could be used to allow the attacker to specialize their attacks against Business Objects Explorer.
Solution
This issue is fixed in the patches listed in the “Support Packages & Patches” section below. The Support Packages & Patches section will be updated with the relevant patch levels once they are released.
For Business Intelligence Platform maintenance schedule and strategy, see the Knowledge Base Article 2144559 in the References section.
Reason and prerequisites
Cookies values disclose Business Objects Explorer user information.
CVSS
Score 5.3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Full note on SAP: SAP Support Launchpad note 2283666
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].