Description
SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected products
- SAP_SE / SAP BusinessObjects Business Intelligence Platform (Web Intelligence)ENTERPRISE 420 – ENTERPRISE 420
- SAP_SE / SAP BusinessObjects Business Intelligence Platform (Web Intelligence)430 – 430
- SAP_SE / SAP BusinessObjects Business Intelligence Platform (Web Intelligence)2025 – 2025
- SAP_SE / SAP BusinessObjects Business Intelligence Platform (Web Intelligence)ENTERPRISECLIENTTOOLS 420 – ENTERPRISECLIENTTOOLS 420