What is CVE-2023-24530?

CVE-2023-24530 is a high-severity vulnerability in SAP Businessobjects Business Intelligence Platform, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.4/10. Published 2023-02-14.

How severe is CVE-2023-24530?

High severity. CVSS v3 base score is 8.4 out of 10.

Arbitrary file upload in SAP Businessobjects Business Intelligence Platform

CVE-2023-24530

SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the application causing high impact on confidentiality, integrity and availability of the application.

Vulnerability class: Unrestricted File Upload

EPSS: 0.006 (43.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H.

Affected products

Sap Businessobjects_business_intelligence_platform — versions 420, 430
Sap Businessobjects Business Intelligence Platform (Cmc) — versions 420, 430

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

cna@sap.com (Permissions Required, Vendor Advisory)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-24530?: CVE-2023-24530 is a high-severity vulnerability in SAP Businessobjects Business Intelligence Platform, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.4/10. Published 2023-02-14.
How severe is CVE-2023-24530?: High severity. CVSS v3 base score is 8.4 out of 10.