NVD Vulnerability Detail
Search Exploit, PoC
CVE-2026-24318
Summary

Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If the application continues to accept previously issued tokens after authentication, the attacker could assume the victim�s authenticated context. This could allow the attacker to access or modify information within the victim�s session scope, impacting confidentiality and integrity, while availability remains unaffected.

Publication Date April 14, 2026, 9:16 a.m.
Registration Date April 15, 2026, 11:39 a.m.
Last Update April 18, 2026, 12:18 a.m.
CVSS3.1 : MEDIUM
スコア 4.2
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC)
攻撃に必要な特権レベル(PR) 不要
利用者の関与(UI)
影響の想定範囲(S) 変更なし
機密性への影響(C)
完全性への影響(I)
可用性への影響(A) なし
Related information, measures and tools
Common Vulnerabilities List