Description
Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server via a crafted delete request using the InfoView web client.
References
- webintelligence-url-delete-files(17422) vdb-entry
- 20040917 Corsaire Security Advisory - Business Objects WebIntelligence arbitrary document deletion issue mailing-list
- 12587 third-party-advisory
- 11208 vdb-entry
- 20040907 Corsaire Security Advisory - Business Objects WebIntelligence arbitrary document deletion issue mailing-list