SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3262810 | Permissions Required Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
18 Jan 2023, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://launchpad.support.sap.com/#/notes/3262810 - Permissions Required, Vendor Advisory | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Sap
Sap businessobjects Business Intelligence Platform |
|
| CPE | cpe:2.3:a:sap:businessobjects_business_intelligence_platform:420:*:*:*:analysis:olap:*:* cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:analysis:olap:*:* |
10 Jan 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-01-10 04:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-0022
Mitre link : CVE-2023-0022
CVE.ORG link : CVE-2023-0022
JSON object : View
Products Affected
sap
- businessobjects_business_intelligence_platform
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')