CVEvulnerability

CVE-2018-2442

8.8 HIGH Published 2018-08-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-08-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-352

Description

In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid.

Affected configurations

• sap businessobjects business intelligence 4.0 • sap businessobjects business intelligence 4.1 • sap businessobjects business intelligence 4.2 • sap internet graphics server 7.20 • sap internet graphics server 7.20ext • sap internet graphics server 7.45 • sap internet graphics server 7.49 • sap internet graphics server 7.53

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References