✕
Request a Demo
Rewterz
Rewterz Threat Advisory – CVE-2019-0274 – SAP Mobile Platform Denial of Service Vulnerability
March 19, 2019
Rewterz
Rewterz Threat Advisory – SAP NetWeaver Business Client Unspecified Vulnerabilities
March 19, 2019

Rewterz Threat Advisory – SAP BusinessObjects BI Multiple Vulnerabilities

Severity

Medium

Analysis Summary

Multiple vulnerabilities have been reported in SAP BusinessObjects BI, which can be exploited by malicious users to disclose sensitive information and cause a DoS (Denial of Service) and by malicious people to conduct cross-site scripting attacks.


CVE-2019-0268

SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source. It can be exploited to disclose otherwise restricted information or cause a DoS condition via a specially crafted XML document including external entity references.

CVE-2019-0269

In SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, certain input related to BI Workspace is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Impact

  • DoS
  • Exposure of sensitive information
  • Cross Site Scripting

Affected Products

SAP BusinessObjects BI 4.x

Remediation

Apply SAP Notes 2689259 and 2693962.

https://launchpad.support.sap.com/#/notes/2689259

https://launchpad.support.sap.com/#/notes/2693962