CVE-2024-28165

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
9.3CRITICAL
EPSS
0.4%
top 41.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Businessobjects Business Intelligence PlatformSAP Businessobjects Business Intelligence Platform
Timeline
PublishedMay 14

Description

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

Patches

Patch: support.sap.com ↗Patch: support.sap.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-r32p-mj73-6wq6: SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL↗2024-05-14
▶
CVEList
Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform↗2024-05-14
▶
CVE-2024-28165 (CRITICAL CVSS 9.3) | SAP Business Objects Business Intel | cvebase.io