CVE-2023-36917CWE-307

Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform

Medium · published July 11, 2023

CVSS v3.1
5.9
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could lead to an attacker to completely takeover a victim’s account.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00585 · 47.2th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2023-07-11T02:48Z
EPSS history
Timeline
  • 11 JUL 02:48Z
    Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform
    cvelistv5