SAP security note 2336393, “Information Disclosure in Business Objects Explorer”. Below are the symptom and SAP recommended solution.
Description
Symptom
In some cases, when a running instance is deleted, the generated document can replace another instance.
Impacts of Information Disclosure:
- Users may gain access to certain documents without having appropriate rights.
Solution
When an instance is deleted while it is in process, an error message is displayed and no document is created. This issue is fixed in the patches listed in the “Support Packages & Patches” section below. For Business Intelligence Platform maintenance schedule and strategy, refer to SAP Note 2144559.
CVSS
Score 7.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2336393
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
