Vulnerability Details : CVE-2022-35169
SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain conditions, enabling the attacker to modify the password or import the file into another system causing high impact on confidentiality but a limited impact on the availability and integrity of the application.
Vulnerability category: Information leak
Exploit prediction scoring system (EPSS) score for CVE-2022-35169
Probability of exploitation activity in the next 30 days: 0.08%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 33 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2022-35169
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
nvd@nist.gov |
|
6.0
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L |
1.2
|
4.7
|
nvd@nist.gov |
CWE ids for CVE-2022-35169
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: cna@sap.com (Primary)
References for CVE-2022-35169
-
https://launchpad.support.sap.com/#/notes/3194361
SAP ONE Support Launchpad: Log OnPermissions Required;Vendor Advisory
-
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
SAP Patch Day BlogVendor Advisory
Products affected by CVE-2022-35169
- cpe:2.3:a:sap:businessobjects_business_intelligence_platform:420:*:*:*:*:*:*:*
- cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:*:*:*:*