5.4med
CVE-2018-2432
SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to i…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 61%
Public exploits
0
none known
Summary
SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking.
Exploit prediction (EPSS)
0.95% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.9 | AV:N/AC:M/Au:S/C:P/I:P/A:N |
Affected products
- SAP SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console)
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- securityfocus.com /bid/104716 · vdb-entry, x_refsource_BID, x_transferred
- launchpad.support.sap.com /#/notes/2523290 · x_refsource_MISC, x_transferred
- wiki.scn.sap.com /wiki/pages/viewpage.action?pageId=497256000 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-2432
- NVD: CVE-2018-2432
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.