Critical severity · published Aug 14, 2018
CVE-2018-2445
AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the…
9.6
CVSS
1.1%
EPSS
No
On KEV
Description
AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery (SSRF) vulnerability.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP BusinessObjects Business Intelligence Platform · SAP
4.1; 4.2 · source: vendor
BB
Businessobjects Business Intelligence · Sap
4.1; 4.2 · source: NVD
Affected product
SB
SAP BusinessObjects Business Intelligence Platform
SAP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-2445
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-2445
Third Party Advisory
http://www.securityfocus.com/bid/105064
Permissions Required
https://launchpad.support.sap.com/#/notes/2630018
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742