{"schemaVersion":3,"id":"CVE-2023-25617","aliases":["GHSA-xxhh-59gh-6ffx","PYSEC-2023-315"],"status":"published","duplicateOf":null,"title":"OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)","description":"SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. Programs could impact the confidentiality, integrity and availability of the system.","dates":{"published":"2023-03-14T04:42:40.759Z","modified":"2025-02-27T18:07:16.954Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00934,"percentile":0.60363,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00934},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00934,"percentile":0.60363}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00934,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00934,"percentile":0.60363}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html"}],"affected":[{"vendor":"PyPI","product":"sap-ai-sdk-base","name":"sap-ai-sdk-base","label":"sap-ai-sdk-base","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/sap-ai-sdk-base","purlType":"pypi","versions":[{"text":"≤ 3.3.0","noFixRecorded":false,"fixedIn":null},{"text":"≤ 430","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.3.0 | ≤ 430","eol":null,"hubHref":null},{"vendor":"sap","product":"business objects (adaptive job server)","name":"Business Objects (Adaptive Job Server)","label":"business objects (adaptive job server)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"420","noFixRecorded":false,"fixedIn":null},{"text":"430","noFixRecorded":false,"fixedIn":null}],"versionsText":"420 | 430","eol":null,"hubHref":"/vendor/sap/business_objects_adaptive_job_server"},{"vendor":"sap","product":"business_objects_business_intelligence_platform","name":"business objects business intelligence platform","label":"business_objects_business_intelligence_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"420","noFixRecorded":false,"fixedIn":null},{"text":"430","noFixRecorded":false,"fixedIn":null}],"versionsText":"420 | 430","eol":null,"hubHref":"/vendor/sap/business_objects_business_intelligence_platform"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://launchpad.support.sap.com/#/notes/3283438","label":"launchpad.support.sap.com","hostname":"launchpad.support.sap.com","tags":["WEB","REPORT","Permissions Required"]},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","label":"www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","hostname":"www.sap.com","tags":["WEB","Advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25617","label":"nvd.nist.gov/vuln/detail/CVE-2023-25617","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/sap-ai-sdk-base/PYSEC-2023-315.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/sap-ai-sdk-base/PYSEC-2023-315.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://www.sap.com/index.html","label":"www.sap.com/index.html","hostname":"www.sap.com","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-xxhh-59gh-6ffx","label":"github.com/advisories/GHSA-xxhh-59gh-6ffx","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-03-14T04:42:40.759Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-02-27T18:07:16.954Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T23:27:25.581Z","stale":false,"partial":false}}