CVE-2023-27894: Sensitive Information Disclosure in the SAP BusinessObjects Business Intelligence platform
First published: Tue Mar 14 2023(Updated: )
SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP BusinessObjects Business Intelligence | =420 | |
| SAP BusinessObjects Business Intelligence | =430 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2023-27894.
What is the severity of CVE-2023-27894?
The severity of CVE-2023-27894 is medium with a severity value of 5.3.
Which versions of SAP BusinessObjects Business Intelligence Platform are affected by CVE-2023-27894?
Versions 420 and 430 of SAP BusinessObjects Business Intelligence Platform are affected by CVE-2023-27894.
What is the impact of CVE-2023-27894?
On successful exploitation, an attacker can inject arbitrary values as CMS parameters and perform lookups on the internal network, which is otherwise not accessible externally.
Are there any references for CVE-2023-27894?
Yes, you can find references for CVE-2023-27894 at the following links: [link1](https://launchpad.support.sap.com/#/notes/3287120), [link2](https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html).
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/softwarecombine
- agent/event
- agent/description
- agent/tags
- vendor/sap
- canonical/sap businessobjects business intelligence
- version/sap businessobjects business intelligence/420
- version/sap businessobjects business intelligence/430