In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3251447 | Permissions Required Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Jan 2023, 18:03
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| First Time |
Sap
Sap business Objects Business Intelligence Platform |
|
| References | (MISC) https://launchpad.support.sap.com/#/notes/3251447 - Permissions Required, Vendor Advisory | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| CPE | cpe:2.3:a:sap:business_objects_business_intelligence_platform:420:*:*:*:*:*:*:* |
10 Jan 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-01-10 04:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-0015
Mitre link : CVE-2023-0015
CVE.ORG link : CVE-2023-0015
JSON object : View
Products Affected
sap
- business_objects_business_intelligence_platform
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')