CVE-2022-41203: sap businessobjects business intelligence

csirt@kutim:~/threat-intel/cve/CVE-2022-41203

CVSS 8.8 · High EPSS 0,99%

Kerentanan Deserialization of Untrusted Data pada sap businessobjects business intelligence. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted data vulnerability. This could highly compromise the Confidentiality, Integrity, and Availability of the system.

Rincian

Terbit di NVD: 8 November 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-502: Deserialization of Untrusted Data
EPSS (30 hari): 0,99% peluang dieksploitasi; lebih tinggi dari 61,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sap	businessobjects business intelligence	Versi 4.2
sap	businessobjects business intelligence	Versi 4.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://launchpad.support.sap.com/#/notes/3243924 permissions required · advisory vendor
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.