Security Focus (CVE-2023-0022) – This CVE is included in SAP’s first 2023 security update. (15th JAN 2023)

Preface: OLAP is all about BI and Big Data. Online analytical processing (OLAP) is an approach to formulate and answer multidimensional queries to large datasets.

Background: SAP have released a new statement of direction for SAP BusinessObjectsthat introduces a new version of the SAP BusinessObjects BI suite code named SAP BusinessObjects BI 2024, available on-premises and through managed cloud. SAP will provide clear use case migration paths for the components that they plan to end support of after 2027.

Vulnerability details: A code injection flaw in the BusinessObjects Business Intelligence platform (CVSS score of 9.9).

SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application.

What was that happen? In what way Does customer will trigger this vulnerability? As usual, vendor did not disclosed the details. But in case of similar design. Attacker will do the attack in this way. For details, please refer to diagram for reference.

Official Announcement: Please see the link for details of this official announcement

Affected Products: SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP), Versions – 420, 430

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.