CVE-2024-25646

high

Description

Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.

References

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

https://me.sap.com/notes/3421384

Details

Source: Mitre, NVD

Published: 2024-04-09

Updated: 2024-09-28

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Severity: High