CVE-2023-42472
Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 12, 2023
- Updated
- Sep 26, 2024
- Reserved
- Sep 11, 2023
Description
Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could intercept the request, modify the content type and the extension to read and modify sensitive data causing a high impact on confidentiality and integrity of the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N | sap |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)SAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.