XSS via Wrong Content-Type in SAP BusinessObjects 430 Web Intf
CVE-2023-23856 Published on February 14, 2023
In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause a low impact on integrity of the application.
Vulnerability Analysis
CVE-2023-23856 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2023-23856 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2023-23856
stack.watch emails you whenever new vulnerabilities are published in SAP Business Objects Business Intelligence Platform or SAP Businessobjects. Just hit a watch button to start following.
Affected Versions
SAP_SE SAP BusinessObjects Business Intelligence (Web Intelligence UI) Version 430 is affected by CVE-2023-23856Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.