CVE-2023-0016 CRITICAL

CVE-2023-0016: SQL Injection vulnerability in SAP Business Planning and Consolidation MS

Vendor Sap

Product SAP BPC MS 10.0

Weakness CWE-89 · SQLi

Published January 10, 2023

Last update April 9, 2025

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data from the backend database.

Key dates

02Disclosure timeline

January 10, 2023 CVE published

April 9, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-0016 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

Identifiers

CVE CVE-2023-0016

CWE CWE-89

CVSS 9.9 / CRITICAL

Affected versions

Vendor Sap

Product SAP BPC MS 10.0

Affected 800

Vendor Sap

Product SAP BPC MS 10.0

Affected 810

CVE-2023-0016: SQL Injection vulnerability in SAP Business Planning and Consolidation MS

01Description

02Disclosure timeline

03References

04Related CVE