CVE-2024-37179

SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3478615	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:businessobjects_business_intelligence:420:::::::*
	cpe:2.3:a:sap:businessobjects_business_intelligence:430:::::::*
	cpe:2.3:a:sap:businessobjects_business_intelligence:2025:::::::*

History

No history.

Information

Published : 2024-10-08 04:15

Updated : 2024-11-14 17:35

NVD link : CVE-2024-37179

Mitre link : CVE-2024-37179

CVE.ORG link : CVE-2024-37179

JSON object : View

Products Affected

sap

businessobjects_business_intelligence

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2024-37179", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-10-08T04:15:06.600", "references": [{"url": "https://me.sap.com/notes/3478615", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application."}, {"lang": "es", "value": "SAP BusinessObjects Business Intelligence Platform permite que un usuario autenticado env\u00ede una solicitud especialmente manipulada al servidor de informes Web Intelligence para descargar cualquier archivo de la m\u00e1quina que aloja el servicio, lo que provoca un alto impacto en la confidencialidad de la aplicaci\u00f3n."}], "lastModified": "2024-11-14T17:35:54.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence:420:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38BA0DF9-D893-4AF9-923E-E47EA5C02C52"}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85CBCF48-5478-4EE5-8F69-6E59EFDB707D"}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence:2025:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB02105F-097A-43AD-B9CC-8D45CEDD1732"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}