Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform

CVE-2023-36917

What is CVE-2023-36917?

The SAP BusinessObjects Business Intelligence Platform versions 420 and 430 are susceptible to a session hijack vulnerability. This allows an attacker, who has gained unauthorized access to a user's session, to circumvent the victim’s old password using brute force tactics. The weakness arises from an unrestricted rate limit in the password change functionality. While this vulnerability does not compromise the integrity or availability of the system, it poses a significant risk of account takeover, potentially granting the attacker full access to the victim's account.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References