SAP Business Intelligence Platform 4.2/4.3 Administration Console BILogon/appService.jsp requested cross site scripting

Summaryinfo

A vulnerability was found in SAP Business Intelligence Platform 4.2/4.3. It has been rated as problematic. This affects an unknown function of the file BILogon/appService.jsp of the component Administration Console. This manipulation of the argument requested as part of Parameter causes cross site scripting. This vulnerability is tracked as CVE-2019-0303. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in SAP Business Intelligence Platform 4.2/4.3 (Business Process Management Software) and classified as problematic. Affected by this vulnerability is an unknown function of the file BILogon/appService.jsp of the component Administration Console. The manipulation of the argument requested as part of a Parameter leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript code when the url is accessed.

The weakness was disclosed 06/14/2019. This vulnerability is known as CVE-2019-0303 since 11/26/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/05/2023). The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

By approaching the search of inurl:BILogon/appService.jsp it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Business Process Management Software

Vendor

• SAP

Name

• Business Intelligence Platform

Version

• 4.2
• 4.3

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion