CVE-2024-28166

SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3433545	Permissions Required
https://me.sap.com/notes/3515653
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:::::::*
	cpe:2.3:a:sap:business_objects_business_intelligence_platform:440:::::::*
	cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_420:::::::*

History

10 Dec 2024, 07:15

Type	Values Removed	Values Added
References		() https://me.sap.com/notes/3515653 -

Information

Published : 2024-08-13 04:15

Updated : 2024-12-10 07:15

NVD link : CVE-2024-28166

Mitre link : CVE-2024-28166

CVE.ORG link : CVE-2024-28166

JSON object : View

Products Affected

sap

business_objects_business_intelligence_platform

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2024-28166", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-08-13T04:15:06.867", "references": [{"url": "https://me.sap.com/notes/3433545", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://me.sap.com/notes/3515653", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "SAP BusinessObjects Business Intelligence\n Platform allows an authenticated attacker to upload malicious code over the\n network, that could be executed by the application. On successful\n exploitation, the attacker can cause a low impact on the Integrity of the\n application."}, {"lang": "es", "value": "La plataforma SAP BusinessObjects Business Intelligence permite a un atacante autenticado cargar c\u00f3digo malicioso a trav\u00e9s de la red, que podr\u00eda ser ejecutado por la aplicaci\u00f3n. Si la explotaci\u00f3n tiene \u00e9xito, el atacante puede causar un impacto bajo en la integridad de la aplicaci\u00f3n."}], "lastModified": "2024-12-10T07:15:04.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EB0EFA3-8AD2-42F2-86E1-A62ECF8340E3"}, {"criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:440:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD397634-7D49-454E-9854-0A8212008655"}, {"criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_420:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "029BEDE8-97DB-4716-8A5D-D7CC8049B93F"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}