CSRF Vulnerability in WebFOCUS Business Intelligence by Information Builders
CVE-2020-14203

8.8HIGH

Key Information:

Vendor

Ibi

Status
Webfocus Business Intelligence
Vendor
CVE Published:
22 June 2020

What is CVE-2020-14203?

WebFOCUS Business Intelligence version 8.0 (SP6) is susceptible to a Cross-Site Request Forgery (CSRF) attack, specifically targeting administrative users through the /ibi_apps/WFServlet(.ibfs) endpoint. This vulnerability could potentially allow an attacker to create an unauthorized administrative user, thereby compromising the security of the application's management functions. Additionally, this vulnerability may be exploited in conjunction with other related security flaws, amplifying the risk to the affected application.

References

https://www.hooperlabs.xyz/disclosures/webfocus.php
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.