What is CVE-2023-25617?

CVE-2023-25617 is a critical-severity vulnerability in SAP Business Objects (Adaptive Job Server), classified under OS Command Injection. CVSS score: 9.0/10. Published 2023-03-14.

How severe is CVE-2023-25617?

Critical severity. CVSS v3 base score is 9.0 out of 10.

Is CVE-2023-25617 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in SAP Business Objects (Adaptive Job Server)

CVE-2023-25617

SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. Programs could impact the confidentiality, integrity and availability of the system.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.009 (56.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

Affected products

Sap Business Objects (Adaptive Job Server) — versions 420, 430
Sap Business_objects_business_intelligence_platform — versions 420, 430

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

karimhabush/cyberowl

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-25617?: CVE-2023-25617 is a critical-severity vulnerability in SAP Business Objects (Adaptive Job Server), classified under OS Command Injection. CVSS score: 9.0/10. Published 2023-03-14.
How severe is CVE-2023-25617?: Critical severity. CVSS v3 base score is 9.0 out of 10.
Is CVE-2023-25617 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.