SAP Note 3275841
SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation.
MediumCVSS 5.4Business Planning and Consolidation
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
- CVE(s)
- CVE-2023-23851
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products and versions
- Product Business Planning and Consolidation
Versions: 200, 300
Appears in
Patch Days listing this note, newest first.
- February 2023MediumCVSS 5.4