CVE-2023-25616 | In some scenario, SAP Business Objects Business Intelligence… | CVSS 9.9 CRITICAL

Description

In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system.

Metadata

CVE ID: CVE-2023-25616
State: PUBLISHED
Assigner: sap
Reserved: 2023-02-09 13:30 UTC
Published: 2023-03-14 04:41 UTC
Last updated: 2025-02-27 18:09 UTC
Primary CWE: CWE-74
CWE-74: Improper Neutralization of Special Elements in Outpu…
Vendor / Product: SAP / Business Objects Business Intelligence Platform (CMC)
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
SAP	Business Objects Business Intelligence Platform (CMC)	—	420, 430

Weakness (CWE)

CWE	Source	Description
CWE-74	cna	CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)