Vulnerability · Published Jul 11, 2023 · Assigned by sap

CVE-2023-36917Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform

Medium 5.9

In plain English

A medium-severity security flaw in SAP BusinessObjects Business Intelligence Platform from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.6%top 51.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could lead to an attacker to completely takeover a victim’s account.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP BusinessObjects Business Intelligence Platform	4.20430

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References