CVE-2023-36917
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
SAP BusinessObjects Business Intelligence Platform versions 420 and 430 allow an unauthorized attacker who hijacked a user session to bypass the victim's old password via brute force due to unrestricted rate limit for password change functionality.
Risk Assessment
Although the attack has no impact on integrity loss or system availability, it could lead to an attacker completely taking over a victim's account.
Recommendation
It is recommended to implement rate limiting for password change functionality and to monitor user sessions for unauthorized activities.
Original NVD description (English source)
SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could lead to an attacker to completely takeover a victim’s account.