7.5
CVE-2019-0352
- EPSS 1.08%
- Veröffentlicht 10.09.2019 17:15:10
- Zuletzt bearbeitet 21.11.2024 04:16:43
- Erkennungen
LoginIn SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Businessobjects Business Intelligence Platform Version 4.10
SAP ≫ Businessobjects Business Intelligence Platform Version 4.20
SAP ≫ Businessobjects Business Intelligence Platform Version 4.30
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.08% | 0.608 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| NIST | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
https://launchpad.support.sap.com/#/notes/2735924
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506