CVE-2023-25616 Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)

Critical 9.9 Published 14 Mar 2023 Updated 27 Feb 2025

Attackers can execute arbitrary code via Program Object execution in SAP Business Objects CMC, leading to privilege escalation and system compromise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-25616?

CVE-2023-25616 is a critical code injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC), published on 14 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system.

Weakness: CWE-74

Which versions are affected by CVE-2023-25616?

It affects 1 product.

Products include Sap Business Objects Business Intelligence Platform.

How do I fix CVE-2023-25616?

No fix has been published for CVE-2023-25616 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-25616 being exploited?

There is no known exploitation of CVE-2023-25616 in the wild and no public exploit code.

Sources

Also known as GHSA-xgfr-99g3-7x24.