漏洞标题
在SAP商业Objects商业智能平台中的敏感信息泄露
漏洞描述信息
在SAP BusinessObjects商业智能平台中敏感信息泄露
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
漏洞类别
N/A
漏洞标题
Sensitive Information Disclosure in the SAP BusinessObjects Business Intelligence platform
漏洞描述信息
SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
漏洞类别
信息暴露
漏洞标题
SAP BusinessObjects Business Intelligence Platform 信息泄露漏洞
漏洞描述信息
SAP BusinessObjects Business Intelligence Platform是德国思爱普（SAP）公司的一款完备的商务分析平台。该平台集市场领先的 SAP 数据整合产品、数据管理产品和商务智能 (BI) 产品于一身，可消除系统集成难题，快速、轻松地部署高性能的商务分析软件。 SAP BusinessObjects Business Intelligence Platform 420版本和430版本存在信息泄露漏洞，该漏洞源于允许攻击者注入任意值作为CMS参数以在内部网络上执行查找，
CVSS信息
N/A
漏洞类别
信息泄露