by Kastro
Paper/Archive/CVE-2023-0016

CVE-2023-0016

SAP SAP BPC MS 10.0 — SQL Injection vulnerability in SAP Business Planning and Consolidation MS

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
40
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 50.4.504 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data from the backend database.

Affected

ProductAffectedFixed inSource
SAP BPC MS 10.0800–CNA
SAP BPC MS 10.0810–CNA

Scores by source

sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reflaunchpad.support.sap.com/#/notes/3275391refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html