CVE-2019-0376
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.
- Score
- CVSS 3.1 5.4 Medium
- Status
- Modified - cna@sap.com
- Published
- 2019-10-08
- Last modified
- 2024-08-04
- Weaknesses
- CWE-79
Affected products
- Businessobjects Business Intelligence Platform (Sap)
- Sap Businessobjects Business Intelligence Platform Web Intelligence Html Interface (Sap Se)
References
- https://launchpad.support.sap.com/#/notes/2817945
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050
