Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Security Note, Information, Input Output Validation, SAP security note 1420608

Description

The SAP Business Objects Enterprise Java Web Portal can be abused by a malicious user allowing them to obtain authentication information from other legitimate users.

In addition, the product can be used to aid in phishing attacks by allowing a malicious user to publish a URL purporting to be from the SAP Business Objects Enterprise Java Web Portal, only to redirect the user to a URL of their own choosing.

The affected release is SAP Business Objects Enterprise Java Web Portal (release XIR2, XIR3 and XIR3.1). More detailed information about affected releases can be found in the section “Reason and Prerequisites”.

Available fix and Supported packages

Affected component

    BI-BIP-ADM
    BI Servers, security, Crystal Reports in Launchpad

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected].

URL

https://launchpad.support.sap.com/#/notes/1420608

TAGS

#Security-Update
#Cross-Site-Scripting
#Cross-Domain-Attack
#Web-Services-Navigator
#XSS
#CSS

More to explorer