CVE-2023-40622 Vulnerability Details

  /     /     /  

CVE-2023-40622 Metadata Quick Info

CVE Published: 12/09/2023 | CVE Updated: 28/09/2024 | CVE Year: 2023
Source: sap | Vendor: SAP_SE | Product: SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Status : PUBLISHED

---

CVE-2023-40622 Description

SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.

Metrics

CVSS Version: 3.1 | Base Score: 9.9 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* NONE
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-732
CWE Name: CWE-732: Incorrect Permission Assignment for Critical Resource
Source: SAP_SE

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).