What is CVE-2023-23851?

CVE-2023-23851 is a medium-severity vulnerability in SAP Business Planning And Consolidation, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 5.4/10. Published 2023-02-14.

How severe is CVE-2023-23851?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Arbitrary file upload in SAP Business Planning And Consolidation

CVE-2023-23851

SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system.

Vulnerability class: Unrestricted File Upload

EPSS: 0.003 (27.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sap Business Planning And Consolidation — versions 200, 300
Sap Business_planning_and_consolidation — versions 200, 300

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

cna@sap.com (Permissions Required, Vendor Advisory)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-23851?: CVE-2023-23851 is a medium-severity vulnerability in SAP Business Planning And Consolidation, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 5.4/10. Published 2023-02-14.
How severe is CVE-2023-23851?: Medium severity. CVSS v3 base score is 5.4 out of 10.