CVE-2018-2432: sap businessobjects_business_intelligence Cross-site Scripting
Vulnerability summary
CVE-2018-2432 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in sap businessobjects_business_intelligence. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.8% of scored vulnerabilities.
Timeline
- 10-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.95%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
0.00 pp
From 0.95% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap2 products
- businessobjects_business_intelligence4.1 | 4.2 | 4.3
- sap businessobjects business intelligence (bi launchpad and central management console)= 4.10 | = 4.20 | = 4.30
1 vendor · 2 products