What’s Vulnerable › Vulnerabilities

CVE-2010-3979

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2010-10-18 · updated 2026-06-16
• Weakness: CWE-200

Description

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username, which allows remote attackers to enumerate account names via a login SOAPAction to the dswsbobje/services/session URI.

Affected products

• SAP_SE SAP BusinessObjects Business Intelligence Platform (Central Management Server): 3.2

References

• http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf
• http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf

Get alerted when CVE-2010-3979 or the next vulnerability affects your stack