Advisory
On 14.03.2023 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within BI/BO platform.
SAP Note 3287120 addresses "[Multiple CVEs] Multiple vulnerabilities in the SAP BusinessObjects Business Intelligence platform" to prevent server-side request forgery (ssrf) information disclosure with a medium risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Risk specification
In SAP Business Objects Business Intelligence Platform (Web Services), an attacker can trick a server into connecting to a malicious BOE server, resulting in a denial of service. Additionally, an attacker could inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. See CVE-2023-27271, CVE-2023-27896 and CVE-2023-27894Solution
The vulnerabilities have been fixed so that an attacker can no longer trick a server into connecting to a malicious server.
Affected System
SAP BusinessObjects Business Intelligence suite is an analytics platform allowing SAP customers to make better decisions based on their business data. SAP BI is a module meant for producing business insights and expands its power in combination with HANA DB and also exists as BW/4 HANA. Due to processing sensitive business data, the Data security is of utmost importance.
The advisory is valid for
- ENTERPRISE 420 87
- ENTERPRISE 430 75
