CVE-2023-36917

Description

SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could lead to an attacker to completely takeover a victim’s account.

Reserved 2023-06-27 | Published 2023-07-11 | Updated 2024-10-23 | Assigner sap

Problem types

CWE-307: Improper Restriction of Excessive Authentication Attempts

Product status

Default status
unaffected

4.20
affected

430
affected

References

me.sap.com/notes/3320702

www.sap.com/.../02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

cve.org (CVE-2023-36917)

nvd.nist.gov (CVE-2023-36917)

Download JSON