What is CVE-2022-35296?

CVE-2022-35296 is a medium-severity vulnerability in SAP Businessobjects Business Intelligence, classified under Information Disclosure. CVSS score: 4.9/10. Published 2022-10-11.

How severe is CVE-2022-35296?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Information disclosure in SAP Businessobjects Business Intelligence

CVE-2022-35296

Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on Confidentiality.

Vulnerability class: Information Disclosure

EPSS: 0.008 (52.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Sap Businessobjects_business_intelligence — versions 420, 430
Sap Se Businessobjects Business Intelligence Platform (Version Management System) — versions 420, 430

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cna@sap.com (Vendor Advisory)
cna@sap.com (Permissions Required, Vendor Advisory)

Frequently asked questions

What is CVE-2022-35296?: CVE-2022-35296 is a medium-severity vulnerability in SAP Businessobjects Business Intelligence, classified under Information Disclosure. CVSS score: 4.9/10. Published 2022-10-11.
How severe is CVE-2022-35296?: Medium severity. CVSS v3 base score is 4.9 out of 10.