Severity
High
Analysis Summary
CVE-2022-41263 CVSS:4.3
SAP Business Objects Business Intelligence Platform could allow a remote authenticated attacker to bypass security restrictions, caused by improper authentication validation. By sending a specially-crafted request, an attacker could exploit this vulnerability to modify the data source information for a restricted document.
CVE-2022-41268 CVSS:9.9
SAP BusinessObjects Business Intelligence Platform is vulnerable to server-side request forgery, caused by an unspecified flaw. By sending a specially-crafted request, an attacker could exploit this vulnerability to conduct SSRF attack.
CVE-2022-41267 CVSS:8.5
SAP Business Planning and Consolidation could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper privilege management. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges to read, change or delete system data.
Impact
- Security Bypass
- Gain Access
- Privilege Escalation
Indicators Of Compromise
CVE
- CVE-2022-41263
- CVE-2022-41268
- CVE-2022-41267
Affected Vendors
SAP
Affected Products
- SAP Business Objects Business Intelligence Platform 4.20
- SAP Business Objects Business Intelligence Platform 4.30
- SAP Business Planning and Consolidation 750
- SAP Business Planning and Consolidation 751
- SAP Business Planning and Consolidation 752
- SAP Business Planning and Consolidation 753
- SAP Business Planning and Consolidation 754
- SAP Business Planning and Consolidation 755
- SAP Business Planning and Consolidation 756
- SAP Business Planning and Consolidation 757
- SAP Business Planning and Consolidation DWCORE 200
- SAP Business Planning and Consolidation DWCORE 300
- SAP Business Planning and Consolidation CPMBPC 810
Remediation
Current SAP customers should refer to SAP note for patch information, available from the SAP Website (login required).