What is CVE-2023-23851?

CVE-2023-23851 is a medium-severity vulnerability in Sap Business Planning And Consolidation, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 5.4/10. Published 2023-02-14.

How severe is CVE-2023-23851?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Arbitrary file upload in Sap Business Planning And Consolidation

CVE-2023-23851

SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious we…

Vulnerability class: Unrestricted File Upload

EPSS: 0.003 (26.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sap Business Planning And Consolidation — versions 200, 300
Sap Business_planning_and_consolidation — versions 200, 300

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

cna@sap.com (Permissions Required, Vendor Advisory)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-23851?: CVE-2023-23851 is a medium-severity vulnerability in Sap Business Planning And Consolidation, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 5.4/10. Published 2023-02-14.
How severe is CVE-2023-23851?: Medium severity. CVSS v3 base score is 5.4 out of 10.