PT-2023-21944 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2023-05-09 · Updated 2023-05-12 · CVE-2023-28762

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform versions 420, 430

Description The issue allows an authenticated attacker with administrator privileges to obtain the login token of any logged-in BI user over the network without any user interaction. This enables the attacker to impersonate any user on the platform, resulting in access and modification of data. Additionally, the attacker can make the system partially or entirely unavailable.

Recommendations For SAP BusinessObjects Business Intelligence Platform versions 420, 430, consider restricting administrator privileges to minimize the risk of exploitation. As a temporary workaround, limit the access to the platform's network to prevent unauthorized token acquisition. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-28762

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 6

• https://osv.dev/vulnerability/CVE-2023-28762 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28762 · Security Note
• https://t.me/cvenotify/50016 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3307833 · Note
• https://t.me/cvenotify/50356 · Telegram Post