PT-2022-4930 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2022-07-04 · Updated 2022-07-20 · CVE-2022-35169

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (LCM) versions 420, 430

Description The issue allows an attacker with admin privileges to read and decrypt the LCMBIAR file's password under certain conditions. This enables the attacker to modify the password or import the file into another system, causing a high impact on confidentiality but a limited impact on the availability and integrity of the application. The vulnerability is related to the lack of protection of service data in the Lifecycle Management console component. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions 420 and 430, consider restricting access to the LCMBIAR file and the Lifecycle Management console to minimize the risk of exploitation. As a temporary workaround, limit the use of admin privileges to only necessary operations until a fix is available. Avoid using the affected LCMBIAR file import functionality in other systems until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-06111

CVE-2022-35169

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35169 · Security Note
• https://bdu.fstec.ru/vul/2022-06111 · Security Note
• https://launchpad.support.sap.com/#/notes/3194361 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35169 · Vendor Advisory