File Upload Vulnerability in SAP Business Planning and Consolidation

CVE-2023-23851

What is CVE-2023-23851?

A file upload vulnerability exists in SAP Business Planning and Consolidation versions 200 and 300, allowing an attacker with legitimate business authorization to upload files without proper validation of the file format. This can lead to the execution of malicious web pages when other users access them, potentially enabling the attacker to perform actions on behalf of those users. This compromises both the confidentiality and integrity of the affected systems, creating significant security risks.

References