CVE-2023-40622

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-40622
SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.

9.9 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3320355 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
https://me.sap.com/notes/3320355 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:businessobjects_business_intelligence:420:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:*:*:*:*
History

21 Nov 2024, 08:19

Type Values Removed Values Added
References () https://me.sap.com/notes/3320355 - Permissions Required () https://me.sap.com/notes/3320355 - Permissions Required
References () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory

28 Sep 2024, 22:15

Type Values Removed Values Added
CWE CWE-200 CWE-732
Summary (en) SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability. (en) SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.

13 Sep 2023, 14:45

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.9
References (MISC) https://me.sap.com/notes/3320355 - (MISC) https://me.sap.com/notes/3320355 - Permissions Required
References (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
First Time Sap
Sap businessobjects Business Intelligence
CPE cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_business_intelligence:420:*:*:*:*:*:*:*

12 Sep 2023, 11:52

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-12 03:15

Updated : 2024-11-21 08:19

NVD link : CVE-2023-40622

Mitre link : CVE-2023-40622

CVE.ORG link : CVE-2023-40622

JSON object : View

Products Affected

sap

  • businessobjects_business_intelligence
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource