CoreCVE
Back

HIGH

Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Published Sep 12, 2023

Description

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could intercept the request, modify the content type and the extension to read and modify sensitive data causing a high impact on confidentiality and integrity of the application.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (3)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner sap
Published Sep 12, 2023
Updated Sep 26, 2024
Reserved Sep 11, 2023
Link CVE-2023-42472

CISA Vulnrichment

Updated Sep 26, 2024

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2023-42472

Red Hat

No data

ENISA EUVD

Assigner sap
Published Sep 12, 2023
Updated Sep 26, 2024
Link EUVD-2023-46912

GitHub

No data