by Kastro
Paper/Archive/CVE-2023-25616

CVE-2023-25616

SAP Business Objects Business Intelligence Platform (CMC) — Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)

EPSS 0.9%CVSS 9.9
critical.is priorityof 100
42
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 61.2.612 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system.

Affected

ProductAffectedFixed inSource
Business Objects Business Intelligence Platform (CMC)420–CNA
Business Objects Business Intelligence Platform (CMC)430–CNA

Scores by source

sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reflaunchpad.support.sap.com/#/notes/3245526refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html