CVE-2004-0533 Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server via a crafted delete r...
LowCVSS 2.1
EPSS 0.69%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server via a crafted delete request using the InfoView web client.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| businessobjects infoview | = 5.1.4 | No fix listed |
| businessobjects infoview | = 5.1.5 | No fix listed |
| businessobjects infoview | = 5.1.6 | No fix listed |
| businessobjects infoview | = 5.1.7 | No fix listed |
| businessobjects infoview | = 5.1.8 | No fix listed |
| businessobjects webintelligence | = 2.7 | No fix listed |
| businessobjects webintelligence | = 2.7.1 | No fix listed |
| businessobjects webintelligence | = 2.7.2 | No fix listed |
| businessobjects webintelligence | = 2.7.3 | No fix listed |
| businessobjects webintelligence | = 2.7.4 | No fix listed |
References
- 20040917 Corsaire Security Advisory - Business Objects WebIntelligence arbitrary document deletion issue mailing-list vendor-advisory
- 20040907 Corsaire Security Advisory - Business Objects WebIntelligence arbitrary document deletion issue mailing-list vendor-advisory
- 12587 third-party-advisory vendor-advisory
- 11208 vdb-entry
- webintelligence-url-delete-files(17422) vdb-entry