What is CVE-2023-25616?

CVE-2023-25616 is a critical-severity vulnerability in SAP Business Objects Intelligence Platform, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.9/10. Published 2023-03-14.

How severe is CVE-2023-25616?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Vulnerability in SAP Business Objects Intelligence Platform

CVE-2023-25616

In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system.

EPSS: 0.009 (57.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Sap Business_objects_business_intelligence_platform — versions 420, 430
Sap Business Objects Intelligence Platform (Cmc) — versions 420, 430

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-25616?: CVE-2023-25616 is a critical-severity vulnerability in SAP Business Objects Intelligence Platform, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.9/10. Published 2023-03-14.
How severe is CVE-2023-25616?: Critical severity. CVSS v3 base score is 9.9 out of 10.