Vulnerability · Published Aug 8, 2023 · Assigned by sap

CVE-2023-37490Binary hijack in SAP BusinessObjects Business Intelligence (Installer)

High 7.6

In plain English

A high-severity uncontrolled search path in SAP BusinessObjects Business Intelligence (Installer) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 81.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an attacker can completely compromise the confidentiality, integrity, and availability of the system

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP BusinessObjects Business Intelligence (Installer)	420430

Weakness: CWE-427 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References