CVE-2019-0376

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform versions prior to 4.2 and 4.3

Description The issue is related to the lack of input sanitization in the Web Intelligence HTML interface of the SAP BusinessObjects Business Intelligence platform. This can be exploited by a remote attacker to perform cross-site scripting attacks. Specifically, it allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.

Recommendations For versions prior to 4.2 and 4.3, update to a version that includes the necessary encoding of user-controlled inputs to prevent the execution of malicious scripts.