CVE-2023-42476: Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence
SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, attacker could access data from reporting databases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-42476?
CVE-2023-42476 has been rated as a high-severity vulnerability due to the potential for JavaScript injection and execution in users' browsers.
How do I fix CVE-2023-42476?
To mitigate CVE-2023-42476, update to the latest version of SAP BusinessObjects Web Intelligence and apply any available security patches.
What type of attack is associated with CVE-2023-42476?
CVE-2023-42476 allows authenticated attackers to perform Cross-Site Scripting (XSS) by injecting malicious JavaScript into Web Intelligence documents.
Who is affected by CVE-2023-42476?
CVE-2023-42476 affects users of SAP BusinessObjects Web Intelligence version 420 who access vulnerable documents.
What can happen if CVE-2023-42476 is exploited?
Successful exploitation of CVE-2023-42476 can lead to unauthorized access to sensitive information and session hijacking through malicious code execution.