PT-2023-27545 · Sap · Sap Business Objects Installer

Published 2023-09-11 · Updated 2023-09-13 · CVE-2023-40623

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Suite Installer versions 420, 430

Description The issue allows an attacker within the network to create a directory under a temporary directory and link it to a directory with operating system files. On successful exploitation, the attacker can delete all the operating system files, causing a limited impact on integrity and completely compromising the availability of the system.

Recommendations For versions 420 and 430, consider restricting access to the temporary directory to prevent an attacker from creating malicious links, and ensure that the system has appropriate backups and security measures in place to mitigate the potential impact of such an attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Operation on Windows Junction

Weakness Enumeration

CWE-1386

Related Identifiers

CVE-2023-40623

Affected Products

Sap Business Objects Installer

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40623 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40623 · Vendor Advisory
• https://t.me/cvenotify/58039 · Telegram Post
• https://twitter.com/CVEnew/status/1701420503024427469 · Twitter Post
• https://me.sap.com/notes/3317702 · Note