CVE-2022-31596 Missing authorization in SAP Business Objects Platform (Monitoring DB)

Medium 6.0 Published 12 Dec 2022 Updated 22 Apr 2025

Authenticated administrators can bypass restrictions to read and modify restricted system data in the SAP BusinessObjects Monitoring database.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-31596?

CVE-2022-31596 is a medium-severity missing authorization vulnerability in SAP Business Objects Platform (Monitoring DB) , published on 12 Dec 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intelligence Platform (Monitoring DB) - version 430, can access BOE Monitoring database to retrieve and modify (non-personal) system data which would otherwise be restricted. Also, a potential attack could be used to leave the CMS's scope and impact the database.

A successful attack could have a low impact on confidentiality, a high impact on integrity, and a low impact on availability.

Weakness: CWE-668

Which versions are affected by CVE-2022-31596?

It affects 1 product.

Products include Sap Business Objects Business Intelligence Platform.

How do I fix CVE-2022-31596?

No fix has been published for CVE-2022-31596 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-31596 being exploited?

There is no known exploitation of CVE-2022-31596 in the wild and no public exploit code.

Sources

Also known as GHSA-x9g8-86pv-45jg.