by Kastro
Paper/Archive/CVE-2023-24530

CVE-2023-24530

SAP BusinessObjects Business Intelligence Platform (CMC) — SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code…

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 46.3.463 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the application causing high impact on confidentiality, integrity and availability of the application.

Affected

ProductAffectedFixed inSource
BusinessObjects Business Intelligence Platform (CMC)420–CNA
BusinessObjects Business Intelligence Platform (CMC)430–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
sap (CNA)8.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reflaunchpad.support.sap.com/#/notes/3256787refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html