CVE-2023-40623: sap_se sap businessobjects suite (installer)

Vulnerability summary

CVE-2023-40623 is a high (CVSS 7.1) vulnerability in sap_se sap businessobjects suite (installer). EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.

Timeline

1. 12-09-2023
   PublishedVulnerability first disclosed.
2. 25-09-2024
   Last modifiedVulnerability information updated.

Description

SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited impact on integrity and completely compromising the availability of the system.

• CWE-1386Insecure Operation on Windows Junction / Mount PointThe product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.