CVE-2023-27894: Sensitive Information Disclosure in the SAP BusinessObjects Business Intelligence platform
SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2023-27894.
What is the severity of CVE-2023-27894?
The severity of CVE-2023-27894 is medium with a severity value of 5.3.
Which versions of SAP BusinessObjects Business Intelligence Platform are affected by CVE-2023-27894?
Versions 420 and 430 of SAP BusinessObjects Business Intelligence Platform are affected by CVE-2023-27894.
What is the impact of CVE-2023-27894?
On successful exploitation, an attacker can inject arbitrary values as CMS parameters and perform lookups on the internal network, which is otherwise not accessible externally.
Are there any references for CVE-2023-27894?
Yes, you can find references for CVE-2023-27894 at the following links: [link1](https://launchpad.support.sap.com/#/notes/3287120), [link2](https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html).