What is CVE-2023-0016?

CVE-2023-0016 is a critical-severity vulnerability in Sap Business_planning_and_consolidation, classified under SQL Injection. CVSS score: 9.9/10. Published 2023-01-10.

How severe is CVE-2023-0016?

Critical severity. CVSS v3 base score is 9.9 out of 10.

SQL Injection in Sap Business_planning_and_consolidation

CVE-2023-0016

SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data…

Vulnerability class: SQL Injection

EPSS: 0.006 (45.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Sap Business_planning_and_consolidation — versions 800, 810
Sap Bpc Ms 10.0 — versions 800, 810

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cna@sap.com (Permissions Required, Vendor Advisory)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-0016?: CVE-2023-0016 is a critical-severity vulnerability in Sap Business_planning_and_consolidation, classified under SQL Injection. CVSS score: 9.9/10. Published 2023-01-10.
How severe is CVE-2023-0016?: Critical severity. CVSS v3 base score is 9.9 out of 10.