Vulnerability · Published Oct 8, 2024 · Assigned by sap
CVE-2024-37179Insecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
High 7.7
In plain English
A high-severity unrestricted file upload in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.4%top 62.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) | ENTERPRISE 4204302025ENTERPRISECLIENTTOOLS 420 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N