CVE-2022-41267 CRITICAL

CVE-2022-41267

Vendor Sap
Product BusinessObjects Business Intelligence Platform
Weakness CWE-434 · Unrestricted file upload
Published December 13, 2022
Last update April 22, 2025
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the system causing a high impact on confidentiality, integrity, and availability of the application.

Key dates

02Disclosure timeline

December 13, 2022 CVE published
April 22, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14390 Video Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2024-9278 HuankeMao SCRM Administrator Backend WxkConfig.php upload_domain_verification_file unrestricted upload CVE-2024-10801 WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload CVE-2023-34007 WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload CVE-2025-34040 Seeyon Zhiyuan OA System Path Traversal File Upload