PT-2023-21048 · Sap · Sap Businessobjects Business Intelligence Platform
CVE-2023-27271
·
Publicado
2023-03-14
·
Atualizado
2023-04-11
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
SAP BusinessObjects Business Intelligence Platform (Web Services) versions 420, 430
Description
The issue allows an attacker to control a malicious BOE server, forcing the application server to connect to its own admintools. This results in a high impact on availability.
Recommendations
For versions 420 and 430, consider restricting access to the admintools to minimize the risk of exploitation until a patch is available.
As a temporary workaround, consider disabling the connection to the BOE server until a fix is provided.
Correção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sap Businessobjects Business Intelligence Platform