PT-2022-20865 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2022-12-12 · Updated 2025-04-22 · CVE-2022-31596

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (Monitoring DB) version 430

Description Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network can access the BOE Monitoring database to retrieve and modify non-personal system data, which would otherwise be restricted. A potential attack could also be used to leave the CMS's scope and impact the database. A successful attack could have a low impact on confidentiality, a high impact on integrity, and a low impact on availability.

Recommendations For version 430, consider restricting access to the BOE Monitoring database and limiting the privileges of CMS administrators to minimize the risk of exploitation. As a temporary workaround, consider disabling access to the database until a patch is available. Restrict access to the Network to prevent attackers from gaining high privileges.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2022-31596

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 8

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31596 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3213507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31596 · Security Note
• https://t.me/cibsecurity/54272 · Telegram Post
• https://t.me/cvenotify/39766 · Telegram Post
• https://t.me/cvenotify/119425 · Telegram Post
• https://t.me/cvenotify/39607 · Telegram Post