PT-2022-15511 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-22541

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform versions 420, 430

Description The issue may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of company data to people that shouldn't or don't need to have access.

Recommendations For versions 420 and 430, restrict access to relational and OLAP connections to minimize the risk of unauthorized data disclosure. As a temporary workaround, consider limiting user permissions to sensitive data until a fix is available. Avoid using relational or OLAP connections for sensitive information until the issue is resolved.

Fix

Weakness Enumeration

CWE-213

Related Identifiers

CVE-2022-22541

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 5

• https://osv.dev/vulnerability/CVE-2022-22541 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22541 · Security Note
• https://launchpad.support.sap.com/#/notes/3137191 · Vendor Advisory
• https://t.me/cvenotify/28772 · Telegram Post