PT-2022-25778 · Sap · Sap Businessobjects Bi Platform

Published 2022-12-13 · Updated 2022-12-15 · CVE-2022-41267

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Objects Platform versions 420, and 430

Description The issue allows an attacker with normal BI user privileges to upload or replace any file on the Business Objects server at the operating system level. This enables the attacker to take full control of the system, causing a high impact on confidentiality, integrity, and availability of the application.

Recommendations For SAP Business Objects Platform versions 420 and 430, update to a version that fixes this issue to prevent attackers from uploading or replacing files on the server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-41267

Affected Products

Sap Businessobjects Bi Platform

References · 5

• https://osv.dev/vulnerability/CVE-2022-41267 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41267 · Security Note
• https://launchpad.support.sap.com/#/notes/3239475 · Vendor Advisory
• https://t.me/cibsecurity/54372 · Telegram Post