What is CVE-2023-0015?

CVE-2023-0015 is a medium-severity vulnerability in Sap Business Objects Intelligence Platform, classified under Cross-site Scripting. CVSS score: 4.6/10. Published 2023-01-10.

How severe is CVE-2023-0015?

Medium severity. CVSS v3 base score is 4.6 out of 10.

XSS in Sap Business Objects Intelligence Platform

CVE-2023-0015

In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (27.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N.

Affected products

Sap Business_objects_business_intelligence_platform — versions 420
Sap Businessobjects Business Intelligence Platform — versions 420

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cna@sap.com (Permissions Required, Vendor Advisory)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-0015?: CVE-2023-0015 is a medium-severity vulnerability in Sap Business Objects Intelligence Platform, classified under Cross-site Scripting. CVSS score: 4.6/10. Published 2023-01-10.
How severe is CVE-2023-0015?: Medium severity. CVSS v3 base score is 4.6 out of 10.