Skip links

Security Note, Information, Input Output Validation, SAP security note 1420608

Description

The SAP Business Objects Enterprise Java Web Portal can be abused by a malicious user allowing them to obtain authentication information from other legitimate users.

In addition, the product can be used to aid in phishing attacks by allowing a malicious user to publish a URL purporting to be from the SAP Business Objects Enterprise Java Web Portal, only to redirect the user to a URL of their own choosing.

The affected release is SAP Business Objects Enterprise Java Web Portal (release XIR2, XIR3 and XIR3.1). More detailed information about affected releases can be found in the section “Reason and Prerequisites”.

Available fix and Supported packages

Affected component

    BI-BIP-ADM
    BI Servers, security, Crystal Reports in Launchpad

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1420608

TAGS

#Security-Update
#Cross-Site-Scripting
#Cross-Domain-Attack
#Web-Services-Navigator
#XSS
#CSS

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer

Initiating SAP Penetration Testing

►   Pentest, short for penetration testing, refers to a set of processes that simulate an attacker’s actions to identify security vulnerabilities. Companies

SAP Security Patch Day RedRays

May 2024 SAP Security Patch Day

Vulnerability: Multiple vulnerabilities in SAP CX Commerce SAP Component: CEC-SCC-PLA-PL CVE ID: CVE-2019-17495 CVSS Score: 9.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Category: Program error