CVE-2022-39800 — Cross-site Scripting in SE SAP Businessobjects Business Intelligence Platform

CWE-79 — Cross-site ScriptingCWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
1.8%
top 17.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Businessobjects Business Intelligence PlatformSAP Businessobjects Business Intelligence
Timeline
PublishedOct 11
Latest updateOct 12

Description

SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the network. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-f496-f9wj-54qx: SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitiz↗2022-10-12
▶
CVEList
CVE-2022-39800: SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitiz↗2022-10-11
▶
CVE-2022-39800 — Cross-site Scripting | cvebase