CVE-2023-23851CWE-434

SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without…

Medium · published February 14, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-02-14T03:11Z
EPSS history
Timeline
  • 14 FEB 03:11Z
    SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without…
    cvelistv5