CVE-2023-27894

SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.

• CWE-200

• https://launchpad.support.sap.com/#/notes/3287120Permissions Required
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
• https://launchpad.support.sap.com/#/notes/3287120Permissions Required
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Published

Mar 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27889Cross-site request forgery (CSRF) vulnerability in LIQUID SP…8.8
• CVE-2023-2789A vulnerability was found in GNU cflow 1.7. It has been rate…7.5
• CVE-2023-27890The Export User plugin through 2.0 for MyBB allows XSS durin…5.4
• CVE-2023-27891rami.io pretix before 4.17.1 allows OAuth application author…7.5
• CVE-2023-27892Insufficient length checks in the ShapeShift KeepKey hardwar…5.7
• CVE-2023-27893An attacker authenticated as a user with a non-administrativ…8.8
• CVE-2023-27895SAP Authenticator for Android - version 1.3.0, allows the sc…6.5
• CVE-2023-27896In SAP BusinessObjects Business Intelligence Platform - vers…7.5
• CVE-2023-27897In SAP CRM - versions 700, 701, 702, 712, 713, an attacker w…6.3
• CVE-2023-27898Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 th…9.6
• CVE-2023-27899Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a…7
• CVE-2023-2790A vulnerability classified as problematic has been found in …5.5