CVE-2014-8315 polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks...
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap businessobjects explorer | = 14.0.5 | No fix listed |
References
- 20141010 SAP Security Note 1908562 - Port scanning in BusinessObjects Explorer mailing-list
- www.csnc.ch
- 20141010 SAP Security Note 1908562 - Port scanning in BusinessObjects Explorer mailing-list
- 70382 vdb-entry
- sap-businessobjects-port-scan-info-disc(96935) vdb-entry
- service.sap.com vendor-advisory