File Upload Vulnerability in SAP Business Planning and Consolidation
CVE-2023-23851

5.4MEDIUM

Key Information:

Vendor
SAP
Status
Business Planning And Consolidation
Vendor
CVE Published:
14 February 2023

Summary

A file upload vulnerability exists in SAP Business Planning and Consolidation versions 200 and 300, allowing an attacker with legitimate business authorization to upload files without proper validation of the file format. This can lead to the execution of malicious web pages when other users access them, potentially enabling the attacker to perform actions on behalf of those users. This compromises both the confidentiality and integrity of the affected systems, creating significant security risks.

Affected Version(s)

Business Planning and Consolidation 200

Business Planning and Consolidation 300

References

https://launchpad.support.sap.com/#/notes/3275841
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.