CVE-2023-27271 Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platform

What is CVE-2023-27271?

CVE-2023-27271 is a medium-severity server-side request forgery vulnerability in Sap Businessobjects Business Intelligence Platform, published on 14 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability.

Weakness: CWE-918

Which versions are affected by CVE-2023-27271?

It affects 1 product.

Products include Sap Businessobjects Business Intelligence Platform.

How do I fix CVE-2023-27271?

No fix has been published for CVE-2023-27271 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-27271 being exploited?

There is no known exploitation of CVE-2023-27271 in the wild and no public exploit code.

Other vulnerabilities in Sap Businessobjects Business Intelligence Platform

• CVE-2023-0018 Cross-site scripting in BusinessObjects Business Intelligence Platform (Central management console) Critical 10.0
• CVE-2023-0022 Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP) Critical 9.9
• CVE-2020-6242 Auth bypass in SAP Business Objects Business Intelligence Platform (Live Data Connect) Critical 9.8
• CVE-2020-26831 XML external entity in SAP BusinessObjects BI Platform (Crystal Report) Critical 9.6
• CVE-2020-6219 Deserialization in Crystal Reports for VS Critical 9.1

All Sap Businessobjects Business Intelligence Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vh2w-9ggj-ccrm.