Insecure Session Management in SAP BusinessObjects Enables Unauthorized Access

Executive Summary

This vulnerability is an insecure session management issue in SAP Business Objects Business Intelligence Platform. It allows an unauthenticated attacker to obtain valid session tokens and reuse them to gain unauthorized access to a victim's session.

If the application accepts previously issued tokens after authentication, the attacker can assume the victim's authenticated context.

This means the attacker could access or modify information within the victim's session scope.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to gain unauthorized access to your session, potentially accessing or modifying confidential information.

This impacts the confidentiality and integrity of your data within the affected session.

However, availability of the system remains unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated attacker to obtain and reuse valid session tokens to gain unauthorized access to a victim's session, potentially accessing or modifying confidential information. Such unauthorized access and potential data exposure could impact the confidentiality and integrity of sensitive data.

While the CVE description does not explicitly mention compliance with standards like GDPR or HIPAA, the impact on confidentiality and integrity of information within user sessions could lead to violations of these regulations, which require protection of personal and sensitive data against unauthorized access.

Useful 0 Not Useful 0