CVE-2023-24530

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-24530
SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the application causing high impact on confidentiality, integrity and availability of the application.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://launchpad.support.sap.com/#/notes/3256787 Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:businessobjects_business_intelligence_platform:420:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:*:*:*:*
History

11 Apr 2023, 22:15

Type Values Removed Values Added
Summary SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the application causing high impact on confidentiality, integrity and availability of the application. SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the application causing high impact on confidentiality, integrity and availability of the application.

21 Feb 2023, 19:16

Type Values Removed Values Added
References (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
References (MISC) https://launchpad.support.sap.com/#/notes/3256787 - (MISC) https://launchpad.support.sap.com/#/notes/3256787 - Permissions Required, Vendor Advisory
First Time Sap
Sap businessobjects Business Intelligence Platform
CPE cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_business_intelligence_platform:420:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1

14 Feb 2023, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-14 04:15

Updated : 2023-12-10 14:48

NVD link : CVE-2023-24530

Mitre link : CVE-2023-24530

CVE.ORG link : CVE-2023-24530

JSON object : View

Products Affected

sap

  • businessobjects_business_intelligence_platform
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type