PT-2024-2972 · Sap · Sap Businessobject Business Intelligence Launch Pad

Published 2024-04-08 · Updated 2025-10-29 · CVE-2024-25646

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObject Business Intelligence Launch Pad (affected versions not specified)

Description The issue is related to improper validation in SAP BusinessObject Business Intelligence Launch Pad, allowing an authenticated attacker to access operating system information using a crafted document. This could have a considerable impact on the confidentiality of the application. The vulnerability is also associated with a lack of protection for service data, which could enable a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

BDU:2024-03139

CVE-2024-25646

Affected Products

Sap Businessobject Business Intelligence Launch Pad

References · 10

• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Patch
• https://osv.dev/vulnerability/CVE-2024-25646 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-25646 · Security Note
• https://twitter.com/cracbot/status/1777930808583414013 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html · Note
• https://twitter.com/CVEnew/status/1777516727712338416 · Twitter Post
• https://t.me/cveNotify/140804 · Telegram Post
• https://t.me/cvenotify/76104 · Telegram Post
• https://me.sap.com/notes/3421384 · Note