CVE-2023-39440
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In SAP BusinessObjects Business Intelligence version 420, if a user logs into a specific program, under certain specific conditions memory may not be cleared properly, which could allow an attacker to access user credentials.
Risk Assessment
The attacker needs local access to the system to carry out the attack. There is no impact on availability and integrity.
Recommendation
It is recommended to monitor local access to the system and update to the latest software version to minimize risk.
Original NVD description (English source)
In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to have local access to the system. There is no impact on availability and integrity.