CVE-2019-0378: XSS

Published Oct 8, 2019

Updated

SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.

Affected Software

5 affected components

SAP BusinessObjects Business Intelligence platform=4.0

SAP BusinessObjects Business Intelligence platform=4.1

SAP BusinessObjects Business Intelligence platform=4.1-sp10

SAP BusinessObjects Business Intelligence platform=4.1-sp11

SAP BusinessObjects Business Intelligence platform=4.1-sp12

Event History

Oct 8, 2019

CVE Published

via MITRE·07:25 PM

Data Sourced

via MITRE·07:25 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-0378?

The severity of CVE-2019-0378 is medium with a severity value of 5.4.

How does CVE-2019-0378 affect SAP BusinessObjects Business Intelligence Platform?

CVE-2019-0378 affects SAP BusinessObjects Business Intelligence Platform versions 4.0, 4.1, 4.1-sp10, 4.1-sp11, and 4.1-sp12.

What is the vulnerability description of CVE-2019-0378?

CVE-2019-0378 is a Stored Cross-Site Scripting vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) before version 4.2.

How can an attacker exploit CVE-2019-0378?

An attacker can exploit CVE-2019-0378 by storing malicious scripts in the file name of the background image.

How can CVE-2019-0378 be fixed?

To fix CVE-2019-0378, upgrade to version 4.2 or later of SAP BusinessObjects Business Intelligence Platform.