CVE-2019-0377: XSS

Published Oct 8, 2019

Updated

SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.

Affected Software

5 affected components

SAP BusinessObjects Business Intelligence platform=4.0

SAP BusinessObjects Business Intelligence platform=4.1

SAP BusinessObjects Business Intelligence platform=4.1-sp10

SAP BusinessObjects Business Intelligence platform=4.1-sp11

SAP BusinessObjects Business Intelligence platform=4.1-sp12

Event History

Oct 8, 2019

CVE Published

via MITRE·07:24 PM

Data Sourced

via MITRE·07:24 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-0377?

CVE-2019-0377 is classified as a medium severity vulnerability due to its potential for Stored Cross-Site Scripting exploitation.

How do I fix CVE-2019-0377?

To fix CVE-2019-0377, upgrade to SAP BusinessObjects Business Intelligence Platform version 4.2 or later.

What type of vulnerability is CVE-2019-0377?

CVE-2019-0377 is a Stored Cross-Site Scripting (XSS) vulnerability that allows attackers to store malicious scripts.

Which SAP versions are affected by CVE-2019-0377?

Versions 4.0 and 4.1 of SAP BusinessObjects Business Intelligence Platform are affected by CVE-2019-0377.

What is the impact of CVE-2019-0377?

The impact of CVE-2019-0377 includes unauthorized script execution within user-controlled inputs, potentially compromising user sessions.