TI-2019-00247 Aliases CVE-2019-0287 GHSA-xh63-pmfx-3pr8

Under certain conditions SAP BusinessObjects Business Intelligence platform (Central…

LOW 37Published 2019-05-14 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.

Why it matters now

EPSS 0.01687 77th percentileScored 2026-11-07

Fix Fixed SAP BusinessObjects Business Intelligence platform (Central Management Server) (SAP SE): 4.2, 4.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP BusinessObjects Business Intelligence platform (Central Management Server)	before 4.2; before 4.3	4.2, 4.3	Patch available	CNA

SAP BusinessObjects Business Intelligence platform (Central Management Server) VendorSAP Affected before 4.2; before 4.3 Fixed in 4.2, 4.3 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:businessobjects:4.2:::::::*	4.2	Vulnerable	SAP
cpe:2.3:a:sap:businessobjects:4.3:::::::*	4.3	Vulnerable	SAP

cpe:2.3:a:sap:businessobjects:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·SAP
cpe:2.3:a:sap:businessobjects:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·SAP

Remediation

Fix · CNA SAP BusinessObjects Business Intelligence platform (Central Management Server) (SAP SE) Fixed in 4.2, 4.3

Timeline

2026-10-02 Threatist record created from CVE-2019-0287
2026-10-03 Alias added: GHSA-xh63-pmfx-3pr8

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032

Other 1

https://launchpad.support.sap.com/#/notes/2737278

TI-2010-00211 Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA… CVSS 2.0HIGH 10.0
TI-2014-07616 SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the… CVSS 2.0HIGH 10.0
TI-2015-06422 SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI… CVSS 2.0HIGH 10.0
TI-2019-00225 Unrestricted file upload in SAP BusinessObjects Business Intelligence Platform Servers CVSS 3.0CRITICAL 9.8
TI-2010-03781 CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain… CVSS 2.0HIGH 9.0
TI-2014-06830 The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to… CVSS 2.0HIGH 7.1

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences