Port Scanning Vulnerability in SAP BusinessObjects Explorer

CVE-2014-8315

Summary

A timing vulnerability exists in SAP BusinessObjects Explorer where the application responds with varied timing based on the ability to establish a connection. This flaw can be exploited by remote attackers, enabling them to conduct port scanning attacks through the use of host names and port numbers in the cms parameter. This behavior can inadvertently disclose information about the network services available on the targeted server, potentially aiding in further attacks.

References