Advisory
On 10.12.2024 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within BI/BO platform.
SAP Note 3515653 addresses "Update 1 to Security Note 3433545: [CVE-2024-42375] Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform" to prevent unrestricted file upload with a medium risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Risk specification
This security note is an update to the security note 3433545. Fix provided in the security note 3433545 is no longer valid. SAP Business Objects Business Intelligence Platform allows an authenticated attacker to upload files causing code execution or manipulation of application data resulting in multiple unrestricted file upload vulnerabilities.Solution
The problem is resolved by frontend and backend validation of format types.
Affected System
SAP BusinessObjects Business Intelligence suite is an analytics platform allowing SAP customers to make better decisions based on their business data. SAP BI is a module meant for producing business insights and expands its power in combination with HANA DB and also exists as BW/4 HANA. Due to processing sensitive business data, the Data security is of utmost importance.
The advisory is valid for
