VulnerabilityAnalyzed
CVE-2024-25646
Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document.
MEDIUM 6.5EPSS 0.42%
Does this matter?
Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.
Description
Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.42% probability · 35th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- sap/businessobjects web intelligence
- Source
- cna@sap.com
References
- https://me.sap.com/notes/3421384Permissions Required
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364Patch
- https://me.sap.com/notes/3421384Permissions Required
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.