Improper Access Control in SAP BusinessObjects Executive

CVE-2022-32244

What is CVE-2022-32244?

An attacker, with CMS administrator credentials, may exploit a vulnerability in SAP BusinessObjects Executive to gain unauthorized access to the BOE Commentary database. This exploitation allows for the retrieval and modification of system data that is otherwise restricted. Although the attack requires high privilege access and proximity on the network, the implications include notable risks to data integrity. While the confidentiality is minimally impacted, the ability to alter system data raises significant concerns for the integrity of the application.

References