Unscored severity · published Oct 16, 2014
CVE-2014-8309
SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user…
–
CVSS
1.7%
EPSS
No
On KEV
Description
SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
Businessobjects · Sap
4.0 · source: NVD
BX
Businessobjects XI · Sap
3.1; r2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8309
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8309
Vendor Advisory
http://scn.sap.com/docs/DOC-8218
seclists.org
http://seclists.org/fulldisclosure/2014/Oct/42
www.onapsis.com
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-029
www.securityfocus.com
http://www.securityfocus.com/archive/1/533647/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/70304
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/96874
More from Businessobjects
9.8
CVE-2019-0259
SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation
7.8
CVE-2022-28214
During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs
7.6
CVE-2019-0287
Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would…
7.3
CVE-2018-2408
Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad
7.1
CVE-2023-40623
SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with…