How severe is CVE-2019-0289?

CVE-2019-0289 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.

Is CVE-2019-0289 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-0289?

CVE-2019-0289 primarily affects Sap Businessobjects. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-0289?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-0289 published?

CVE-2019-0289 was published on 2019-05-14 and last updated on 2026-06-17.

CVE-2019-0289

CVE-2019-0289 is a high-severity vulnerability in Sap Businessobjects with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.1)
CVSS v2: 5.8
EPSS exploit prediction: 1% (61st percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Sap Businessobjects
Published: 2019-05-14
Last modified: 2026-06-17

Description

Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.

Frequently asked questions

What is CVE-2019-0289?: Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.
How severe is CVE-2019-0289?: CVE-2019-0289 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.
Is CVE-2019-0289 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-0289?: CVE-2019-0289 primarily affects Sap Businessobjects. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-0289?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-0289 published?: CVE-2019-0289 was published on 2019-05-14 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:sap:businessobjects:4.2:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects:4.3:*:*:*:*:*:*:*

More vulnerabilities in Sap Businessobjects

CVE-2015-7730 — Critical (CVSS 10.0): SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote…
CVE-2014-9387 — Critical (CVSS 10.0): SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain…
CVE-2010-0219 — Critical (CVSS 10.0): Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other…
CVE-2019-0259 — Critical (CVSS 9.8): SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script…
CVE-2010-3983 — Critical (CVSS 9.0): CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors…
CVE-2022-28214 — High (CVSS 7.8): During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication…

All CVEs affecting Sap Businessobjects →