SB2023080921 - Multiple vulnerabilities in SAP BusinessObjects Business Intelligence suite
Published: August 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Dependency on vulnerable third-party component (CVE-ID: N/A)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application uses a vulnerable version of Apache Commons FileUpload. A remote attacker can perform a denial of service (DoS) attack.
2) Insufficient verification of data authenticity (CVE-ID: CVE-2023-37490)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing verification of data authenticity in SAP BusinessObjects Installer application. An attacker with control over the network share from which the application is being installed can replace files in temporary directory with malicious ones and compromise the affected system.
3) Cleartext storage of sensitive information (CVE-ID: CVE-2023-39440)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to application stores user's credentials in plain text in memory. If a victim logs into a particular program, under certain specific conditions memory might not be cleared up properly. A local user can read memory contents, extract credentials of another user and login to the application.
Remediation
Install update from vendor's website.