Paper/Archive/CVE-2024-28165

CVE-2024-28165

SAP_SE SAP BusinessObjects Business Intelligence Platform — Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

EPSS 0.6%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (NVD)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 46.9.469 × 209.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application

Affected

ProductAffectedFixed inSource

SAP BusinessObjects Business Intelligence Platform430–CNA

SAP BusinessObjects Business Intelligence Platform440–CNA

business_objects_business_intelligence_platform430–CISA-ADP

business_objects_business_intelligence_platform440–CISA-ADP

Scores by source

NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

sap (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3431794 refsupport.sap.com/en/my-support/knowledge-base/security-notes-news.html