CVE-2023-42476CWE-79

Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence

Medium · published December 12, 2023

CVSS v3.1
6.8
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, attacker could access data from reporting databases.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00573 · 46.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-12-12T00:58Z
EPSS history
Timeline
  • 12 DEC 00:58Z
    Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence
    cvelistv5