← Vulnerability feed

Vulnerability record · CVE-2014-8309 · published 16 October 2014

CVE-2014-8309: Sap businessobjects information exposure vulnerability

Sap · Businessobjects

SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.

5.0 CVSS 2.0 Medium EPSS 1.7% · top 24.1% CWE-200 · Information exposure
5.0CVSS 2.0 base score
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
14References
17 Jun 2026Last modified by NVD

Description

SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://scn.sap.com/docs/DOC-8218 Vendor Advisory
http://seclists.org/fulldisclosure/2014/Oct/42
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-029
http://www.securityfocus.com/archive/1/533647/100/0/threaded
http://www.securityfocus.com/bid/70304
https://exchange.xforce.ibmcloud.com/vulnerabilities/96874
https://service.sap.com/sap/support/notes/2001109 Vendor Advisory
http://scn.sap.com/docs/DOC-8218 Vendor Advisory
http://seclists.org/fulldisclosure/2014/Oct/42
http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-029
http://www.securityfocus.com/archive/1/533647/100/0/threaded
http://www.securityfocus.com/bid/70304
https://exchange.xforce.ibmcloud.com/vulnerabilities/96874
https://service.sap.com/sap/support/notes/2001109 Vendor Advisory

Track CVE-2014-8309 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2015-7730Sap businessobjects memory buffer overflow vulnerabilitySAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of servi…EPSS 3.6%10.0CVE-2014-9387Sap businessobjects permissions and access controls vulnerabilitySAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORB…EPSS 4.6%10.0CVE-2010-0219Apache Axis2 default admin password enables remote code executionApache Axis2, as bundled in products such as SAP BusinessObjects Enterprise XI 3.2 and CA ARCserve D2D r15, ships with a default password of 'axis2' …EPSS 91%analysed9.8CVE-2019-0259Sap businessobjects unrestricted file upload vulnerabilitySAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file for…EPSS 2.0%9.0CVE-2010-3983Sap businessobjects permissions and access controls vulnerabilityCmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and…EPSS 1.7%7.8CVE-2022-28214Sap businessobjects cleartext storage of sensitive data vulnerabilityDuring an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed…EPSS 0.17%7.6CVE-2019-0287Sap businessobjects vulnerabilityUnder certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to …EPSS 1.7%7.3CVE-2018-2408Sap businessobjects vulnerabilityImproper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password ch…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2014-8309), CISA KEV, FIRST EPSS (scores of 2026-09-30). This page is refreshed as NVD updates the record.