PT-2022-18881 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-28216

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (BI Workspace) version 420

Description The issue is related to a Cross-Site Scripting attack that can be performed by an unauthenticated attacker due to improper sanitization of the user inputs on the network. On successful exploitation, an attacker can access certain reports, causing a limited impact on confidentiality of the application data.

Recommendations For SAP BusinessObjects Business Intelligence Platform (BI Workspace) version 420, update to a version that properly sanitizes user inputs to prevent Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to sensitive reports and implementing additional input validation measures to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28216

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 6

• https://osv.dev/vulnerability/CVE-2022-28216 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28216 · Security Note
• https://launchpad.support.sap.com/#/notes/3150845 · Vendor Advisory
• https://t.me/cvenotify/29209 · Telegram Post
• https://t.me/cibsecurity/40652 · Telegram Post