Skip to main content

Business Objects Business Intelligence Platform CVE-2022-39015

MEDIUM
Exposure of Resource to Wrong Sphere (CWE-668)
2022-10-11 cna@sap.com
Information Disclosure Business Objects Business Intelligence Platform
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 11, 2022 - 21:15 nvd
MEDIUM 6.5

DescriptionNVD

Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted.

AnalysisAI

Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Resource to Wrong Sphere (CWE-668), which allows attackers to access resources from an unintended security context. Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted. Affected products include: Sap Business Objects Business Intelligence Platform.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement proper access controls, validate resource access permissions, use security boundaries.

More in Business Objects Business Intelligence Platform

View all
CVE-2024-41730 CRITICAL
9.8 Aug 13

In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an u
CVE-2023-25617 HIGH
8.8 Mar 14

SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, wh
CVE-2023-25616 HIGH
8.8 Mar 14

In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object executio
CVE-2022-41267 HIGH
8.8 Dec 13

SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/repla
CVE-2023-42478 HIGH
7.6 Dec 12

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic

CVE-2022-39013 HIGH
7.6 Oct 11

Under certain conditions an authenticated attacker can get access to OS credentials. Rated high severity (CVSS 7.6), thi
CVE-2022-24398 MEDIUM
6.5 Mar 10

Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticate
CVE-2022-31596 MEDIUM
6.0 Dec 12

Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Networ
CVE-2023-23856 MEDIUM
5.4 Feb 14

In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json wit
CVE-2023-0015 MEDIUM
5.4 Jan 10

In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return
CVE-2022-31598 MEDIUM
5.4 Jul 12

Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a m
CVE-2022-32246 MEDIUM
4.6 Jul 12

SAP Busines Objects Business Intelligence Platform (Visual Difference Application) - versions 420, 430, allows an authen

Same weakness CWE-668 – Exposure of Resource to Wrong Sphere

View all
CVE-2021-46354 HIGH POC
7.5
CVE-2017-0215 MEDIUM
5.3
CVE-2026-45411 CRITICAL POC
9.8
CVE-2023-45911 CRITICAL POC
9.8
CVE-2020-10271 CRITICAL POC
9.8
CVE-2020-10867 CRITICAL POC
9.8
CVE-2019-19015 CRITICAL POC
9.8
CVE-2018-7072 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2022-39015 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy