PT-2023-28362 · Sap · Sap Business Objects Web Intelligence

Published 2023-12-11 · Updated 2023-12-14 · CVE-2023-42476

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Objects Web Intelligence version 420

Description The issue allows an authenticated attacker to inject JavaScript code into Web Intelligence documents, which is then executed in the victim's browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, the attacker could access data from reporting databases.

Recommendations For SAP Business Objects Web Intelligence version 420, update to a version that includes a fix for this issue to prevent JavaScript code injection and potential data exposure. As a temporary workaround, consider restricting access to Web Intelligence documents to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-42476

Affected Products

Sap Business Objects Web Intelligence

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-42476 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42476 · Vendor Advisory
• https://twitter.com/CVEnew/status/1734394504772530467 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1734465764365668425 · Twitter Post
• https://me.sap.com/notes/3382353 · Note
• https://t.me/cvenotify/63606 · Telegram Post