CVE-2022-31596

6MEDIUM

Key Information:

Vendor
SAP
Status
SAP Business Objects Platform (monitoring Db)
Vendor
CVE Published:
12 December 2022

Summary

Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intelligence Platform (Monitoring DB) - version 430, can access BOE Monitoring database to retrieve and modify (non-personal) system data which would otherwise be restricted. Also, a potential attack could be used to leave the CMS's scope and impact the database.

A successful attack could have a low impact on confidentiality, a high impact on integrity, and a low impact on availability.

Affected Version(s)

SAP Business Objects Platform (Monitoring DB) 430

References

https://launchpad.support.sap.com/#/notes/3213507
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.