Log in Start free

Vulnerability · Published May 9, 2023 · Assigned by sap

CVE-2023-31404Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service)

Medium 5.0

In plain English

A medium-severity information exposure in SAP BusinessObjects Business Intelligence Platform (Central Management Service) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.5%top 59.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could let them access data sources which would otherwise be restricted.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP BusinessObjects Business Intelligence Platform (Central Management Service) 420430

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References