CVE-2019-1010147

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-07-26 · updated 2026-06-17
Weakness: CWE-79

Description

Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.

Affected products

BMC Remedy Smart Reporting: all versions
Yellowfinbi Yellowfin Bi: before 7.3 — fixed in 7.3

How to fix

Upgrade to a fixed version: Yellowfinbi Yellowfin Bi 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-1010147 or the next vulnerability affects your stack