CVE-2024-37179CWE-434

Insecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

High · published October 8, 2024

CVSS v3.1
7.7
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-10-08T03:21Z
EPSS history
Timeline
  • 08 OCT 03:21Z
    Insecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
    cvelistv5