{"api_version":"1","generated_at":"2026-07-23T10:21:16+00:00","cve":"CVE-2019-0346","urls":{"html":"https://cve.report/CVE-2019-0346","api":"https://cve.report/api/cve/CVE-2019-0346.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-0346","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0346"},"summary":{"title":"CVE-2019-0346","description":"Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2019-08-14 14:15:00","updated_at":"2020-08-24 17:37:00"},"problem_types":["CWE-319"],"metrics":[],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017","refsource":"MISC","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – August 2019 - Product Security Response at SAP - Community Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://launchpad.support.sap.com/#/notes/2764513","name":"https://launchpad.support.sap.com/#/notes/2764513","refsource":"MISC","tags":["Permissions Required","Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0346","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0346","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"346","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence","cpe6":"4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"346","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence","cpe6":"4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2019-0346","ASSIGNER":"cna@sap.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"SAP SE","product":{"product_data":[{"product_name":"SAP Business Objects Business Intelligence Platform (CMC)","version":{"version_data":[{"version_name":"<","version_value":"4.2"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Information Disclosure"}]}]},"references":{"reference_data":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017","refsource":"MISC","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017"},{"url":"https://launchpad.support.sap.com/#/notes/2764513","refsource":"MISC","name":"https://launchpad.support.sap.com/#/notes/2764513"}]}},"nvd":{"publishedDate":"2019-08-14 14:15:00","lastModifiedDate":"2020-08-24 17:37:00","problem_types":["CWE-319"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:businessobjects_business_intelligence:4.2:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"346","Ordinal":"136754","Title":"CVE-2019-0346","CVE":"CVE-2019-0346","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"346","Ordinal":"1","NoteData":"Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"346","Ordinal":"2","NoteData":"2019-08-14","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"346","Ordinal":"3","NoteData":"2019-08-14","Type":"Other","Title":"Modified"}]}}}