SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.
References
| Link | Resource |
|---|---|
| https://me.sap.com/notes/3320355 | Permissions Required |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
28 Sep 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability. | |
| CWE | CWE-732 |
13 Sep 2023, 14:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sap:businessobjects_business_intelligence:420:*:*:*:*:*:*:* cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:*:*:*:* |
|
| First Time |
Sap
Sap businessobjects Business Intelligence |
|
| References | (MISC) https://me.sap.com/notes/3320355 - Permissions Required | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.9 |
12 Sep 2023, 11:52
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-12 03:15
Updated : 2024-09-28 22:15
NVD link : CVE-2023-40622
Mitre link : CVE-2023-40622
CVE.ORG link : CVE-2023-40622
JSON object : View
Products Affected
sap
- businessobjects_business_intelligence
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource