CVE-2023-42472CWE-434

Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

High · published September 12, 2023

CVSS v3.1
8.7
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could intercept the request, modify the content type and the extension to read and modify sensitive data causing a high impact on confidentiality and integrity of the application.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00597 · 47.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-09-12T01:58Z
EPSS history
Timeline
  • 12 SEP 01:58Z
    Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
    cvelistv5