{"api_version":"1","generated_at":"2026-07-23T09:34:23+00:00","cve":"CVE-2019-0352","urls":{"html":"https://cve.report/CVE-2019-0352","api":"https://cve.report/api/cve/CVE-2019-0352.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-0352","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0352"},"summary":{"title":"CVE-2019-0352","description":"In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2019-09-10 17:15:00","updated_at":"2019-09-11 12:20:00"},"problem_types":["CWE-200"],"metrics":[],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2735924","name":"https://launchpad.support.sap.com/#/notes/2735924","refsource":"MISC","tags":["Permissions Required","Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – September 2019 - Product Security Response at SAP - SCN Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0352","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0352","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"352","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence_platform","cpe6":"4.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"352","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence_platform","cpe6":"4.20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"352","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence_platform","cpe6":"4.30","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"352","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence_platform","cpe6":"4.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"352","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence_platform","cpe6":"4.20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"352","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence_platform","cpe6":"4.30","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2019-0352","ASSIGNER":"cna@sap.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"SAP SE","product":{"product_data":[{"product_name":"SAP BusinessObjects Business Intelligence Platform (CMC)","version":{"version_data":[{"version_name":"<","version_value":"4.1"},{"version_name":"<","version_value":"4.2"},{"version_name":"<","version_value":"4.3"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Other"}]}]},"references":{"reference_data":[{"url":"https://launchpad.support.sap.com/#/notes/2735924","refsource":"MISC","name":"https://launchpad.support.sap.com/#/notes/2735924"},{"refsource":"CONFIRM","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506","url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506"}]}},"nvd":{"publishedDate":"2019-09-10 17:15:00","lastModifiedDate":"2019-09-11 12:20:00","problem_types":["CWE-200"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.10:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.20:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.30:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"352","Ordinal":"136760","Title":"CVE-2019-0352","CVE":"CVE-2019-0352","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"352","Ordinal":"1","NoteData":"In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"352","Ordinal":"2","NoteData":"2019-09-10","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"352","Ordinal":"3","NoteData":"2019-09-10","Type":"Other","Title":"Modified"}]}}}