What is CVE-2023-31404?

CVE-2023-31404 is a medium-severity vulnerability in Sap Businessobjects Business Intelligence, classified under Information Disclosure. CVSS score: 5.0/10. Published 2023-05-09.

How severe is CVE-2023-31404?

Medium severity. CVSS v3 base score is 5.0 out of 10.

Information disclosure in Sap Businessobjects Business Intelligence

CVE-2023-31404

Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could let them access data sources which would otherwise be restricted.

Vulnerability class: Information Disclosure

EPSS: 0.005 (37.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.

Affected products

Sap Businessobjects_business_intelligence — versions 420, 430
Sap_se Sap Businessobjects Business Intelligence Platform (Central Management Service) — versions 420, 430

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cna@sap.com (Permissions Required, Vendor Advisory)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-31404?: CVE-2023-31404 is a medium-severity vulnerability in Sap Businessobjects Business Intelligence, classified under Information Disclosure. CVSS score: 5.0/10. Published 2023-05-09.
How severe is CVE-2023-31404?: Medium severity. CVSS v3 base score is 5.0 out of 10.