CVE-2023-25617

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. Programs could impact the confidentiality, integrity and availability of the system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-256186.5SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791,CVE-2023-256197.5A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wh CVE-2023-25624.3The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox func CVE-2023-256206.5A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wh CVE-2023-256216.5Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the CVE-2023-25634.3The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.CVE-2023-256325.5The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.CVE-2023-256410.0OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.CVE-2023-256426.5There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an aut CVE-2023-256438.8There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network pa CVE-2023-256447.5There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, CVE-2023-256457.7There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged appli