FKIE_CVE-2014-8309

Vulnerability from fkie_nvd - Published: 2014-10-16 19:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.
References
cve@mitre.orghttp://scn.sap.com/docs/DOC-8218Vendor Advisory
cve@mitre.orghttp://seclists.org/fulldisclosure/2014/Oct/42
cve@mitre.orghttp://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-029
cve@mitre.orghttp://www.securityfocus.com/archive/1/533647/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/70304
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/96874
cve@mitre.orghttps://service.sap.com/sap/support/notes/2001109Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://scn.sap.com/docs/DOC-8218Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2014/Oct/42
af854a3a-2127-422b-91ae-364da2661108http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-029
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/533647/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/70304
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/96874
af854a3a-2127-422b-91ae-364da2661108https://service.sap.com/sap/support/notes/2001109Vendor Advisory
Impacted products
Vendor Product Version
sap businessobjects 4.0
sap businessobjects_xi 3.1
sap businessobjects_xi r2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:businessobjects:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "71F0E7EB-FCFE-48AD-B8C3-5D411DF6BA07",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:businessobjects_xi:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF32F47A-26FB-4D10-B53F-31C408DB428B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:businessobjects_xi:r2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0B5D84F-9D6D-42B2-AD49-14177ACBD51D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service."
    },
    {
      "lang": "es",
      "value": "SAP BusinessObjects 4.0 y BusinessObjects XI (BOXI) R2 y 3.1 generan mensajes de error tras un intento de inicio de sesi\u00f3n fallido con diferente tiempo de retraso dependiendo de si la cuenta de usuario existe o no, lo que permite a atacantes remotos enumerar nombres de usuario v\u00e1lidos a trav\u00e9s de peticiones de autenticaci\u00f3n SecEnterprise al servicio web Session."
    }
  ],
  "id": "CVE-2014-8309",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-10-16T19:55:19.817",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://scn.sap.com/docs/DOC-8218"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://seclists.org/fulldisclosure/2014/Oct/42"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-029"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/533647/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/70304"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96874"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://service.sap.com/sap/support/notes/2001109"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://scn.sap.com/docs/DOC-8218"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2014/Oct/42"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-029"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/533647/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/70304"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96874"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://service.sap.com/sap/support/notes/2001109"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.