affected:
- ecosystem_specific: {}
  package:
    ecosystem: PyPI
    name: sap-ai-sdk-base
    purl: pkg:pypi/sap-ai-sdk-base
  ranges:
  - events:
    - introduced: '0'
    - last_affected: '420'
    - last_affected: '430'
    type: ECOSYSTEM
  versions:
  - 3.1.2
  - 3.1.3
  - 3.1.6
  - 3.2.0
  - 3.2.3
  - 3.4.0
aliases:
- CVE-2023-25617
- GHSA-xxhh-59gh-6ffx
details: |+
  SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. Programs could impact the confidentiality, integrity and availability of the system.

id: PYSEC-2023-315
modified: '2026-05-21T14:54:42.800803Z'
published: '2023-03-14T05:15:29.877Z'
references:
- type: ADVISORY
  url: https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- type: REPORT
  url: https://launchpad.support.sap.com/#/notes/3283438
- type: ADVISORY
  url: https://github.com/advisories/GHSA-xxhh-59gh-6ffx
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  type: CVSS_V3