CVE-2019-0333: Medium severity sap businessobjects business intelligence platform vulnerability

Published Aug 14, 2019

Updated

In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.

Affected Software

1 affected component

SAP BusinessObjects Business Intelligence=4.2

Event History

Aug 14, 2019

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this SAP BusinessObjects Business Intelligence Platform vulnerability?

The vulnerability ID for this SAP BusinessObjects Business Intelligence Platform vulnerability is CVE-2019-0333.

What is the severity of CVE-2019-0333?

The severity of CVE-2019-0333 is medium with a CVSS score of 6.5.

What is affected by CVE-2019-0333?

Versions 4.2 and 4.3 of SAP BusinessObjects Business Intelligence Platform (Web Intelligence) are affected by CVE-2019-0333.

How can an attacker exploit CVE-2019-0333?

An attacker can exploit CVE-2019-0333 by canceling a query in SAP BusinessObjects Business Intelligence Platform and then querying and receiving the whole data set instead of just what is part of their authorized security profile.

Is there a fix for CVE-2019-0333?

Yes, there is a fix available for CVE-2019-0333. Please refer to the SAP notes 2764513 and the SAP SCN wiki page for more information.