Description
On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user credentials, which will allow them to read or modify the remote server files.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected products
- SAP_SE / SAP BusinessObjects Business Intelligence PlatformENTERPRISE 420 – ENTERPRISE 420
- SAP_SE / SAP BusinessObjects Business Intelligence Platform430 – 430
- SAP_SE / SAP BusinessObjects Business Intelligence Platform440 – 440