Deserialization in Sap Businessobjects_business_intelligence
CVE-2022-41203
In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious seri…
Vulnerability class: Insecure Deserialization
EPSS: 0.009 (55.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sap Businessobjects_business_intelligence — versions 4.2, 4.3
- Sap Se Businessobjects Business Intelligence Platform (Central Management Console And Bi Launchpad) — versions = 4.2, = 4.3
Weakness classification (CWE)
References
- cna@sap.com (Vendor Advisory)
- cna@sap.com (Permissions Required, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-41203?
- CVE-2022-41203 is a high-severity vulnerability in Sap Businessobjects_business_intelligence, classified under Deserialization of Untrusted Data. CVSS score: 8.8/10. Published 2022-11-08.
- How severe is CVE-2022-41203?
- High severity. CVSS v3 base score is 8.8 out of 10.