Medium severity5.4NVD Advisory· Published Jul 10, 2018· Updated Jun 17, 2026

CVE-2018-2432

Description

SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking.

Affected products

SAP/Businessobjects Business Intelligence4 versions
cpe:2.3:a:sap:businessobjects_business_intelligence:4.1:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:sap:businessobjects_business_intelligence:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:sap:businessobjects_business_intelligence:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:sap:businessobjects_business_intelligence:4.3:*:*:*:*:*:*:*
- (no CPE)range: =4.10, =4.20, =4.30
SAP/Sap Businessobjects Business Intelligence Platform (central Management Console)cpe-rescue
Range: = 4.10

Patches

Vulnerability mechanics

References

wiki.scn.sap.com/wiki/pages/viewpage.actionnvdPatchVendor Advisory
www.securityfocus.com/bid/104716nvdThird Party AdvisoryVDB Entry
launchpad.support.sap.comnvdPermissions Required

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000