CVE-2023-40623mediumCWE-1386

CVE-2023-40623: medium-severity vulnerability in SAP_SE SAP BusinessObjects Suite (Installer)

Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)

Published · Updated

Follow this CVE+ Monitor SAP BusinessObjects Suite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.2epss 0.4%
In short

The SAP BusinessObjects Suite installer allows an attacker on the network to create a fake link to system files and delete them, breaking the system. This happens because the installer doesn't properly protect temporary directories.

Technical detail

CWE-1386 vulnerability in SAP BusinessObjects Suite installer (v420, v430) allows local network attackers to create directory junctions in temporary directories pointing to OS-critical paths, enabling arbitrary file deletion. Exploitation requires local or adjacent network access and compromises system availability and integrity through deletion of operating system files.

Summary generated and translated by AI from the official description.
SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited impact on integrity and completely compromising the availability of the system.
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H
Affected products
SAP_SE · SAP BusinessObjects Suite (Installer)