PT-2023-15950 · Sap · Sap Businessobjects Business Intelligence Platform Cmc Application

Publicado 2023-01-10 · Atualizado 2023-01-13 · CVE-2023-0018

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform CMC application versions 420, and 430

Description The issue arises from improper input sanitization of user-controlled input in the SAP BusinessObjects Business Intelligence Platform CMC application. An attacker with basic user-level privileges can modify or upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens them is susceptible to stored XSS attacks. As a result, information maintained in the victim's web browser can be read, modified, and sent to the attacker.

Recommendations For versions 420 and 430, consider disabling the ability to modify or upload crystal reports until a patch is available. Restrict access to the CMC application to minimize the risk of exploitation. Avoid using the application to view or open reports from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-0018

Produtos afetados

Sap Businessobjects Business Intelligence Platform Cmc Application

Referências · 6

• https://t.me/cvenotify/41954 · Publicação no Telegram
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0018 · Nota de Segurança
• https://t.me/cibsecurity/56207 · Publicação no Telegram
• https://launchpad.support.sap.com/#/notes/3266006 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-0018 · Aviso do Fabricante