Unscored severity · published Dec 31, 2004
CVE-2004-0533
Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server…
–
CVSS
0.7%
EPSS
No
On KEV
Description
Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server via a crafted delete request using the InfoView web client.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Infoview · Businessobjects
5.1.4; 5.1.5; 5.1.6; 5.1.7; 5.1.8 · source: NVD
WE
Webintelligence · Businessobjects
2.7; 2.7.1; 2.7.2; 2.7.3; 2.7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0533
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0533
Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0056.html
Vendor Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026549.html
Vendor Advisory
http://secunia.com/advisories/12587/
www.securityfocus.com
http://www.securityfocus.com/bid/11208
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/17422
More from Infoview
–
CVE-2008-1894
Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows…
–
CVE-2004-0534
Cross-site scripting (XSS) vulnerability in Business Objects InfoView 5.1.4 through 5.1.8 for WebIntelligence 2.7.0 through 2.7.4 allows remote attackers to inject arbitrary web…