CVE-2023-23851

CWE-434 — Unrestricted File Upload4 documents4 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 55.32%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SAP Business Planning AND Consolidation

Timeline

PublishedFeb 14

Latest updateJan 23

Description

SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5sap/business_planning_and_consolidation200, 300+1

▶NVDsap/business_planning_and_consolidation200, 300+1

🔴Vulnerability Details

CVEList

CVE-2023-23851: SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages)↗2023-02-14

▶

GHSA

GHSA-rmf8-wm54-9xq4: SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages)↗2023-02-14

▶

📋Vendor Advisories

Red Hat

kernel: copy_params can attempt to allocate more than INT_MAX bytes and crash↗2024-01-23

▶