CVE-2023-24530

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the application causing high impact on confidentiality, integrity and availability of the application.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-245319.8Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executi CVE-2023-245325.3The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a CVE-2023-245337.5Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked CVE-2023-245347.5HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of servic CVE-2023-245357.5Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more CVE-2023-245367.5Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This CVE-2023-245377.5Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loo CVE-2023-245389.8Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, si CVE-2023-245397.3Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated CVE-2023-24547.2schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacke CVE-2023-245409.8Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the ch CVE-2023-245426.7Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user t