Vulnerability · Published Sep 13, 2022 · Assigned by sap

CVE-2022-32244

Medium 5.2

In plain English

A medium-severity information exposure in SAP BusinessObjects Business Intelligence Platform (Commentary DB) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS NVD)5.2Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify system data but can't make the system unavailable. This needs the attacker to have high privilege access to the same physical/logical network to access information which would otherwise be restricted, leading to low impact on confidentiality and high impact on integrity of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP BusinessObjects Business Intelligence Platform (Commentary DB)	420430

Weakness: CWE-200

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3213524 x_refsource_MISC