CVE-2023-42478

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-424796.1An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-CVE-2023-42484.3The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing CVE-2023-424805.3The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the CVE-2023-424818.1In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misus CVE-2023-424827.5Samsung Mobile Processor Exynos 2200 allows a GPU Use After Free.CVE-2023-424834.7A TOCTOU race condition in Samsung Mobile Processor Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, and Exynos CVE-2023-424867.8Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges.CVE-2023-424877.5Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-424887.5EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-424899.8EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource CVE-2023-42499.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.0 CVE-2023-424907.5EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor