Lucene search

SapCVE-2023-27271

HistoryMar 14, 2023 - 6:15 a.m.

CVE-2023-27271

2023-03-1406:15:11

CWE-918

sap

web.nvd.nist.gov

sap

businessobjects

platform

web services

cve-2023-27271

security

vulnerability

nvd

exploit

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

41.3%

JSON

In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability.

Affected configurations

Nvd

Node

sapbusinessobjects_business_intelligence_platformMatch420

sapbusinessobjects_business_intelligence_platformMatch430

VendorProductVersionCPE
sapbusinessobjects_business_intelligence_platform420cpe:2.3:a:sap:businessobjects_business_intelligence_platform:420:*:*:*:*:*:*:*
sapbusinessobjects_business_intelligence_platform430cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	businessobjects_business_intelligence_platform	420	cpe:2.3:a:sap:businessobjects_business_intelligence_platform:420:::::::*
sap	businessobjects_business_intelligence_platform	430	cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "BusinessObjects Business Intelligence Platform (Web Services)",
    "vendor": "SAP",
    "versions": [
      {
        "status": "affected",
        "version": "420"
      },
      {
        "status": "affected",
        "version": "430"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3287120

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

41.3%

JSON

Related for CVE-2023-27271