Paper/Archive/CVE-2023-37490

CVE-2023-37490

SAP_SE SAP BusinessObjects Business Intelligence (Installer) — Binary hijack in SAP BusinessObjects Business Intelligence (Installer)

EPSS 0.3%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (NVD)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 18.5.185 × 203.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an attacker can completely compromise the confidentiality, integrity, and availability of the system

Affected

ProductAffectedFixed inSource

SAP BusinessObjects Business Intelligence (Installer)420–CNA

SAP BusinessObjects Business Intelligence (Installer)430–CNA

Scores by source

NVD9.0CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

sap (CNA)7.6CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References

refme.sap.com/notes/3317710 refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html