CVE-2018-2446 Information disclosure in SAP BusinessObjects Business Intelligence
Unauthenticated attackers can read sensitive server information via admin tools in SAP BusinessObjects Business Intelligence.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-2446?
CVE-2018-2446 is a high-severity vulnerability in SAP BusinessObjects Business Intelligence, published on 14 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information (server name), hence leading to an information disclosure.
Which versions are affected by CVE-2018-2446?
It affects 1 product.
Products include Sap Businessobjects Business Intelligence.
How do I fix CVE-2018-2446?
No fix has been published for CVE-2018-2446 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-2446 being exploited?
There is no known exploitation of CVE-2018-2446 in the wild and no public exploit code.
Other vulnerabilities in SAP BusinessObjects Business Intelligence
- CVE-2023-40622 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
- CVE-2022-41203 Deserialization in SAP BusinessObjects Business Intelligence Platform (Central Management Console and BI Launchpad)
- CVE-2023-28765 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
- CVE-2018-2445 Server-side request forgery in SAP BusinessObjects Business Intelligence Platform
- CVE-2023-28762 Information Disclosure in SAP BusinessObjects Intelligence Platform
Sources
Also known as GHSA-74cw-4rxr-9g52.