SAP Vulnerabilities and Affected Products
Vulnerabilities associated with BusinessObjects Business Intelligence Platform (Web Services).
Products
Clear product- NetWeaver19 vulnerabilities
- NetWeaver AS for ABAP and ABAP Platform7 vulnerabilities
- SAP BusinessObjects Business Intelligence Platform5 vulnerabilities
- SAP Fiori Client5 vulnerabilities
- commerce_cloud4 vulnerabilities
- Solution Manager4 vulnerabilities
- BusinessObjects Business Intelligence Platform (Web Services)3 vulnerabilities
- NetWeaver Application Server for ABAP and ABAP Platform3 vulnerabilities
- NetWeaver AS ABAP (BSP Framework)3 vulnerabilities
- NetWeaver AS for Java3 vulnerabilities
- SAP BusinessObjects Business Intelligence3 vulnerabilities
- SAP HANA extended application services3 vulnerabilities
- SAP Internet Graphics Server (IGS)3 vulnerabilities
- Application Interface Framework (Message Dashboard)2 vulnerabilities
- Business Planning and Consolidation2 vulnerabilities
- business_objects_business_intelligence_platform2 vulnerabilities
- commerce_hycom2 vulnerabilities
- CRM (WebClient UI)2 vulnerabilities
- NetWeaver Process Integration2 vulnerabilities
- netweaver_application_server_java2 vulnerabilities
- SAP Adaptive Server Enterprise (ASE)2 vulnerabilities
- SAP BusinessObjects Business Intelligence Suite2 vulnerabilities
- SAP Enterprise Financial Services2 vulnerabilities
- SAP HANA2 vulnerabilities
- SAP NetWeaver AS Java (ServerCore)2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-27894MEDIUM | Sensitive Information Disclosure in the SAP BusinessObjects Business Intelligence platformSAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting … CWE-200Mar 14, 2023 | CVSS5.0v3.1 | EPSS0.617% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-27896MEDIUM | Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platformIn SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability. CWE-918Mar 14, 2023 | CVSS6.5v3.1 | EPSS0.524% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-27271MEDIUM | Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platformIn SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability. CWE-918Mar 14, 2023 | CVSS6.5v3.1 | EPSS0.57% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |