Vulnerability Details CVE-2018-2442
In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 45.6%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.8
References
- http://www.securityfocus.com/bid/105078
- https://launchpad.support.sap.com/#/notes/2407193
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742
- http://www.securityfocus.com/bid/105078
- https://launchpad.support.sap.com/#/notes/2407193
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742
Products affected by CVE-2018-2442
-
cpe:2.3:a:sap:businessobjects_business_intelligence:4.0
-
cpe:2.3:a:sap:businessobjects_business_intelligence:4.1
-
cpe:2.3:a:sap:businessobjects_business_intelligence:4.2
-
cpe:2.3:a:sap:internet_graphics_server:7.20
-
cpe:2.3:a:sap:internet_graphics_server:7.20ext
-
cpe:2.3:a:sap:internet_graphics_server:7.45
-
cpe:2.3:a:sap:internet_graphics_server:7.49
-
cpe:2.3:a:sap:internet_graphics_server:7.53