SAP security note 1971294, “‘Secure’ flag was not set on cookies for Query Builder Application”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Query Builder Application can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.
Solution
The issue is resolved in the following releases:
- SAP BusinessObjects BI XI 3.1 SP06 Patch05
- SAP BusinessObjects BI XI 3.1 SP07 Patch02
- SAP BusinessObjects BI 4.0 SP06 Patch12
- SAP BusinessObjects BI 4.0 SP09 Patch1
- SAP BusinessObjects BI 4.0 SP10
- SAP BusinessObjects BI 4.10 SP04
Please apply the appropriate patch to resolve the issue. The tentative release dates for SPs and Patches are available in the BusinessObjects Maintenance Schedule.
Patch release dates are tentative and subject to change. You need to apply this patch to the Business Objects Platform. Refer to SAP Note 330793 for instructions on downloading patches from the SAP Service Marketplace.
Reason and prerequisites
The lack of the ‘Secure’ flag on cookies for the Query Builder Application allows attackers to modify application content without authorization and potentially access authentication information from other legitimate users.
References
- SAP BusinessObjects Maintenance Schedule
- Download Patches
Affected components
- BI-BIP-ADM – Business intelligence solutions > Business intelligence platform > BI Servers, security, Crystal Reports in Launchpad
Full note on SAP: SAP Support Launchpad note 1971294
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].