PT-2019-1771 · Sap · Sap Businessobjects

Publicado 2019-02-12 · Atualizado 2019-02-20 · CVE-2019-0259

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects versions 4.2 and 4.3

Description The issue is related to the lack of proper file format validation, allowing an attacker to upload any file, including script files. This can potentially lead to the execution of arbitrary code by a remote attacker. The vulnerability is associated with unlimited file upload of dangerous types.

Recommendations For SAP BusinessObjects versions 4.2 and 4.3, consider restricting file uploads to only necessary and validated formats to minimize the risk of exploitation. As a temporary workaround, consider disabling the file upload feature in the Visual Difference component until a patch is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

BDU:2019-01415

CVE-2019-0259

Produtos afetados

Sap Businessobjects

Referências · 6

• https://bdu.fstec.ru/vul/2019-01415 · Nota de Segurança
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0259 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-0259 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2727564 · Aviso do Fabricante
• http://securityfocus.com/bid/106997 · Nota