The version of SAP BusinessObjects Business Intelligence Platform installed on the remote host is prior to 4.2 SP009 001900, 4.3 SP003 001200, 4.3 SP004 000600, or 4.3 SP005 000000. It is, therefore, affected by multiple vulnerabilities as referenced in the 3433545 advisory.

  - SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious   code over the network, that could be executed by the application. On successful exploitation, the attacker   can cause a low impact on the Integrity of the application. (CVE-2024-42375)

  - SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to upload malicious   files to BI file repository over the network. For an attacker to bypass the front-end file format check, in   depth system knowledge is required. On successful exploitation, the attacker could modify some data causing   low impact on Integrity of the application. (CVE-2024-28166)

  - SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious   files to BI file repository over the network. For an attacker to bypass the front-end file format check, in   depth system knowledge is required. On successful exploitation, the attacker could modify some data causing   low impact on Integrity of the application. (CVE-2024-41731)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SAP BusinessObjects Business Intelligence Platform Multiple Vulnerabilities (3433545)

medium Nessus Plugin ID 207852

Version 1.2

Version 1.1

Version 1.2 Oct 11, 2024, 5:40 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202410111740
Version 1.1 Sep 27, 2024, 10:13 PM New Plugin Feed: 202409272213