CVE-2014-8309

MEDIUM 5.0CVE-2014-8309 · Published 16/10/2014 · updated 17/06/2026

In short

CVE-2014-8309 is a MEDIUM (CVSS 5.0) vulnerability affecting businessobjects (sap), businessobjects xi (sap).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 76.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
businessobjects sap	`= 4.0`	No fix yet
businessobjects xi sap	`= 3.1= r2`	No fix yet

Description

SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.

References

More vulnerabilities in businessobjects

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

businessobjects

sap

= 4.0

No fix yet

businessobjects xi

sap

= 3.1= r2

No fix yet

Description

More vulnerabilities in businessobjects

See all →