CVE-2014-8309: SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logo...

Security readout for executives and security teams

This issue lets a remote attacker infer whether SAP BusinessObjects usernames are valid because failed logon responses take different amounts of time. It does not grant access by itself, but it can make password guessing, phishing, and credential stuffing more targeted. Exposure is most relevant where affected SAP BusinessObjects authentication web services are reachable by untrusted networks. The bundle does not provide CPEs, deployment defaults, CVSS, or detailed version/build boundaries beyond the named product versions. Address during normal vulnerability management unless the service is internet-facing or protects sensitive business reporting data. External exposure increases priority because username enumeration improves attacker targeting before password attacks or phishing. Mitigation focus: Check SAP Note 2001109 and current SAP guidance for applicable fixes or configuration changes.; Restrict external access to BusinessObjects authentication and Session web service endpoints.; Monitor failed logon patterns for enumeration-like activity..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.