CVE-2014-8309

Currently unrated

Key Information:

Vendor
SAP
Status
Businessobjects Xi
Businessobjects
Vendor
CVE Published:
16 October 2014

Summary

SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.

References

https://service.sap.com/sap/support/notes/2001109
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/96874
vdb-entryx_refsource_XF
http://www.securityfocus.com/archive/1/533647/100/0/threaded
mailing-listx_refsource_BUGTRAQ

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.