CVE-2018-2408: High severity sap businessobjects business intelligence vulnerability

Published Apr 10, 2018

Updated

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active.

Affected Software

4 affected components

SAP BusinessObjects=4.0

SAP BusinessObjects=4.10

SAP BusinessObjects=4.20

SAP BusinessObjects=4.30

Event History

Apr 10, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2018-2408?

CVE-2018-2408 is a vulnerability in the SAP Business Objects software that allows active sessions to remain active after a user changes their password.

What is the severity of CVE-2018-2408?

The severity of CVE-2018-2408 is high with a CVSS score of 7.3.

Which versions of SAP Business Objects are affected by CVE-2018-2408?

Versions 4.0, 4.10, 4.20, and 4.30 of SAP Business Objects are affected by CVE-2018-2408.

How can I fix CVE-2018-2408?

To fix CVE-2018-2408, apply the security patches provided by SAP and ensure that users are prompted to re-authenticate after changing their passwords.

Where can I find more information about CVE-2018-2408?

You can find more information about CVE-2018-2408 on the SecurityFocus website, the SAP Security Patch Day April 2018 blog post, and the SAP Note 2537150.