CRITICAL🇵🇱 Wersja polska

CVE-2023-0018

CVSS 10.0v3.1pub. 2023-01-10upd. 2024-11-21

Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a result of the attack, information maintained in the victim's web browser can be read, modified, and sent to the attacker.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Sap Businessobjects Business Intelligence Platform

    APP
    Sap
    420430
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2023-0022CRITICAL9.9PL ✓same product

SAP BusinessObjects BI — zdalne wykonanie kodu przez uwierzytelnionego użytkownika

CVE-2020-26831CRITICAL9.6PL ✓same product

SAP BusinessObjects BI Platform — SSRF i ujawnienie plików przez XML Injection

CVE-2020-6294CRITICAL9.1PL ✓same product

SAP BusinessObjects BI Platform – brak uwierzytelnienia w komponencie Xvfb (Unix)

CVE-2020-6242CRITICAL9.8PL ✓same product

SAP BusinessObjects BI Platform — logowanie bez hasła do CMC (Missing Authentication)

CVE-2020-6195CRITICAL9.8PL ✓same product

SAP BusinessObjects BI Platform CMC ujawnia hasło w plaintext w odpowiedzi HTTP