Medium severity · published Sep 12, 2023
CVE-2023-37489
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected product
SB
SAP BusinessObjects Business Intelligence Platform (Version Management System)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37489
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37489
Permissions Required
https://me.sap.com/notes/3352453
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from SAP BusinessObjects Business Intelligence Platform (Version Management System)
4.9
CVE-2022-35296
Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network…