CVE-2022-41203 | In some workflow of SAP BusinessObjects BI Platform (Central… | CVSS 9.9 CRITICAL

Description

In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted data vulnerability. This could highly compromise the Confidentiality, Integrity, and Availability of the system.

Metadata

CVE ID: CVE-2022-41203
State: PUBLISHED
Assigner: sap
Reserved: 2022-09-21 00:00 UTC
Published: 2022-11-08 00:00 UTC
Last updated: 2025-05-01 17:49 UTC
Primary CWE: CWE-502
CWE-502
Vendor / Product: SAP SE / SAP BusinessObjects Business Intelligence Platform (Central Management Console and BI Launchpad)
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
SAP SE	SAP BusinessObjects Business Intelligence Platform (Central Management Console and BI Launchpad)	—	= 4.2, = 4.3

Weakness (CWE)

CWE	Source	Description
CWE-502	cna	CWE-502

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)