CVE-2023-23856
Quick assessment
Affected
SAP_SE SAP BusinessObjects Business Intelligence (Web Intelligence UI)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP BusinessObjects Business Intelligence Platform是德国思爱普（SAP）公司的一款完备的商务分析平台。该平台集市场领先的 SAP 数据整合产品、数据管理产品和商务智能 (BI) 产品于一身，可消除系统集成难题，快速、轻松地部署高性能的商务分析软件。 SAP BusinessObjects Business Intelligence (Web Intelligence user interface) 430版本存在跨站脚本漏洞。攻击者利用该漏洞执行跨站脚本攻
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-23856
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause a low impact on integrity of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
SAP BusinessObjects Business Intelligence 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP BusinessObjects Business Intelligence Platform是德国思爱普（SAP）公司的一款完备的商务分析平台。该平台集市场领先的 SAP 数据整合产品、数据管理产品和商务智能 (BI) 产品于一身，可消除系统集成难题，快速、轻松地部署高性能的商务分析软件。 SAP BusinessObjects Business Intelligence (Web Intelligence user interface) 430版本存在跨站脚本漏洞。攻击者利用该漏洞执行跨站脚本攻
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP BusinessObjects Business Intelligence (Web Intelligence UI) | 430 | - |
|
II. Public POCs for CVE-2023-23856
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-23856
请登录查看更多情报信息。
Other References for CVE-2023-23856 (2)
Same Patch Batch · SAP_SE · 2023-02-14 · 4 CVEs total
| CVE-2023-0020 | 8.5 HIGH | SAP BusinessObjects Business Intelligence 信息泄露漏洞 |
| CVE-2023-0019 | 6.5 MEDIUM | SAP GRC 安全漏洞 |
| CVE-2023-23858 | 6.1 MEDIUM | SAP NetWeaver AS 跨站脚本漏洞 |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-89124
Missing Authorization Check in SAP Global Trade Services, ed -
CVE-2026-89122
Open Redirect Vulnerability in SAP NetWeaver Enterprise Port -
CVE-2026-89121
Missing Authorization Check in SAP S/4HANA (Linear Asset Man -
CVE-2026-89120
Missing authorization check in SAP ABAP Platform -
CVE-2026-89118
Information Disclosure vulnerability in SAP NetWeaver Enterp
Same weakness: CWE-79
-
CVE-2026-115457
baserCMS: Unauthenticated Stored XSS via Shortcode Expansion -
CVE-2026-93638
Zimbra Collaboration Suite Pre-Authentication Reflected Cros -
CVE-2026-93633
Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass -
CVE-2026-115754
serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </ -
CVE-2026-10632
Zimbra Collaboration Suite Classic Web Client Reflected Cros
V. Comments for CVE-2023-23856
No comments yet