CVE-2024-28166 LOW

CVE-2024-28166: Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform

Vendor Sap_Se
Product SAP BusinessObjects Business Intelligence Platform
Weakness CWE-434 · Unrestricted file upload
Published August 13, 2024
Last update December 10, 2024

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.

Key dates

02Disclosure timeline

August 13, 2024 CVE published
December 10, 2024 Record updated