CVE-2023-42476— Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence
Quick assessment
Affected
SAP_SE SAP BusinessObjects Web Intelligence
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Business Objects Web Intelligence是德国思爱普（SAP）公司的一个集中套件。用于数据报告、可视化和共享。 SAP Business Objects Web Intelligence 420版本存在跨站脚本漏洞，该漏洞源于允许经过身份验证的攻击者注入JavaScript代码，成功利用该漏洞可能会导致数据泄露。
Possible ATT&CK Techniques 3 AI
T1001 · Data Obfuscation T1005 · Data from Local System T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-42476
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence
Source: CVE Program / CVE List V5
Vulnerability Description
SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, attacker could access data from reporting databases.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Business Objects Web Intelligence 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Business Objects Web Intelligence是德国思爱普（SAP）公司的一个集中套件。用于数据报告、可视化和共享。 SAP Business Objects Web Intelligence 420版本存在跨站脚本漏洞，该漏洞源于允许经过身份验证的攻击者注入JavaScript代码，成功利用该漏洞可能会导致数据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP BusinessObjects Web Intelligence | 420 | - |
|
II. Public POCs for CVE-2023-42476
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-42476
请登录查看更多情报信息。
Other References for CVE-2023-42476 (1)
Same Patch Batch · SAP_SE · 2023-12-12 · 16 CVEs total
| CVE-2023-49583 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/ |
| CVE-2023-50422 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-se |
| CVE-2023-50423 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud- |
| CVE-2023-50424 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github |
| CVE-2023-42481 | 8.1 HIGH | Improper Access Control vulnerability in SAP Commerce Cloud |
| CVE-2023-42478 | 7.5 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Plat |
| CVE-2023-49580 | 7.3 HIGH | Information disclosure in SAP GUI for Windows and SAP GUI for Java |
| CVE-2023-6542 | 7.1 HIGH | Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID |
| CVE-2023-49587 | 6.4 MEDIUM | Command Injection vulnerability in SAP Solution Manager |
| CVE-2023-42479 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct |
| CVE-2023-49577 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution) |
| CVE-2023-49584 | 4.3 MEDIUM | Client-Side Desynchronization vulnerability in SAP Fiori Launchpad |
| CVE-2023-49581 | 4.1 MEDIUM | SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform |
| CVE-2023-49058 | 3.5 LOW | Directory Traversal vulnerability in SAP Master Data Governance |
| CVE-2023-49578 | 3.5 LOW | Denial of service (DOS) in SAP Cloud Connector |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-79
-
CVE-2026-102626
LimeSurvey Community Edition 7.4.0 - Stored XSS through the -
CVE-2026-104847
ProseMirror: XSS vulnerability in prosemirror-view's paste h -
CVE-2026-104907
MISP: JavaScript Injection via Remote Tag ID in Event Previe -
CVE-2026-104906
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Outpu -
CVE-2026-104901
MISP ID Translator: Unescaped Remote Event ID Enables Cross-
V. Comments for CVE-2023-42476
No comments yet