CVE-2018-2447 describes a medium-severity vulnerability in SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2. This flaw allows an authenticated attacker to execute specially crafted InfoObject queries, leading to the exposure of the CMS InfoObjects database. With a CVSS score of 6.5, the attack requires low privileges and network access, resulting in a high impact on confidentiality but no impact on integrity or availability. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.2CPE matchmatch criteria | cpe:2.3:a:sap:businessobjects_business_intelligence:4.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.