CVE-2023-0018 Cross-site scripting in BusinessObjects Business Intelligence Platform (Central management console)

Critical 10.0 Published 10 Jan 2023 Updated 9 Apr 2025

An attacker with basic privileges can inject malicious scripts into Crystal Reports, leading to stored XSS that allows reading and modifying victim browser data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-0018?

CVE-2023-0018 is a critical cross-site scripting vulnerability in Sap Businessobjects Business Intelligence Platform, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a result of the attack, information maintained in the victim's web browser can be read, modified, and sent to the attacker.

Weakness: CWE-79

Which versions are affected by CVE-2023-0018?

It affects 1 product.

Products include Sap Businessobjects Business Intelligence Platform.

How do I fix CVE-2023-0018?

No fix has been published for CVE-2023-0018 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-0018 being exploited?

There is no known exploitation of CVE-2023-0018 in the wild and no public exploit code.

All Sap Businessobjects Business Intelligence Platform vulnerabilities

Sources

Also known as GHSA-3c29-2h4x-fgg4.