CVE-2023-42472 HIGH

CVE-2023-42472: Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Vendor Sap_Se
Product SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Weakness CWE-434 · Unrestricted file upload
Published September 12, 2023
Last update September 26, 2024
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could intercept the request, modify the content type and the extension to read and modify sensitive data causing a high impact on confidentiality and integrity of the application.

Key dates

02Disclosure timeline

September 12, 2023 CVE published
September 26, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-5261 Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload CVE-2023-51409 WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability CVE-2021-24490 Email Artillery <= 4.1 - Arbitrary File Upload CVE-2025-11320 zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted upload CVE-2025-7340 HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload