CVE-2019-0287

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.

Metrics

CVSS 3.0 7.6/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Affected software

Vendor	Product	Versions
SAP SE	SAP BusinessObjects Business Intelligence platform (Central Management Server)	< 4.2; < 4.3

References

http://www.securityfocus.com/bid/108316Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2737278Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032Vendor Advisory
http://www.securityfocus.com/bid/108316Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2737278Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032Vendor Advisory

Timeline

Published: May 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-02897.1Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to CVE-2019-02915.5Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.CVE-2019-02936.5Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information CVE-2019-02986.1SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XS CVE-2019-03018.8Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST I CVE-2019-03036.1SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting CVE-2019-03049.8FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRN CVE-2019-03054.3Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, CVE-2019-03064.3SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as S CVE-2019-03072.4Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communicat CVE-2019-03086.8An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price o CVE-2019-03116.1Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode u