CVE-2023-23851

5.4MEDIUM

Key Information:

Vendor
SAP
Status
Business Planning and Consolidation
Vendor
CVE Published:
14 February 2023

Summary

SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system.

Affected Version(s)

Business Planning and Consolidation 200

Business Planning and Consolidation 300

References

https://launchpad.support.sap.com/#/notes/3275841
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.