PT-2023-19252 · Sap · Sap Business Planning/Consolidation

Published 2023-02-14 · Updated 2023-04-12 · CVE-2023-23851

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Planning and Consolidation versions 200, 300

Description The issue allows an attacker with business authorization to upload any files, including web pages, without proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent, impacting the confidentiality and integrity of the system.

Recommendations For versions 200 and 300, consider restricting file upload capabilities to authorized users and implementing proper file format validation to prevent malicious file uploads. As a temporary workaround, consider disabling the file upload feature until a patch is available. Restrict access to uploaded files to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-23851

Affected Products

Sap Business Planning/Consolidation

References · 6

• https://launchpad.support.sap.com/#/notes/3275841 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23851 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23851 · Security Note
• https://t.me/cvenotify/48078 · Telegram Post
• https://t.me/cibsecurity/58066 · Telegram Post