PT-2023-28362 · Sap · Sap Business Objects Web Intelligence

CVE-2023-42476 · Publicado 2023-12-11 · Atualizado 2023-12-14

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Objects Web Intelligence version 420

Description The issue allows an authenticated attacker to inject JavaScript code into Web Intelligence documents, which is then executed in the victim's browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, the attacker could access data from reporting databases.

Recommendations For SAP Business Objects Web Intelligence version 420, update to a version that includes a fix for this issue to prevent JavaScript code injection and potential data exposure. As a temporary workaround, consider restricting access to Web Intelligence documents to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-42476

Produtos afetados

Sap Business Objects Web Intelligence

Referências · 7

• https://twitter.com/CVEnew/status/1734394504772530467 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1734465764365668425 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-42476 · Nota de Segurança
• https://me.sap.com/notes/3382353 · Nota
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-42476 · Aviso do Fabricante
• https://t.me/cvenotify/63606 · Publicação no Telegram