CVE-2022-41267 File upload in BusinessObjects Business Intelligence Platform

Critical 9.9 Published 13 Dec 2022 Updated 22 Apr 2025

An attacker with normal user privileges can upload or replace arbitrary files on the server, leading to full system control and compromise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-41267?

CVE-2022-41267 is a critical vulnerability in SAP BusinessObjects Business Intelligence Platform, published on 13 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the system causing a high impact on confidentiality, integrity, and availability of the application.

Weakness: CWE-434

Which versions are affected by CVE-2022-41267?

It affects 1 product.

Products include Sap Business Objects Business Intelligence Platform.

How do I fix CVE-2022-41267?

No fix has been published for CVE-2022-41267 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-41267 being exploited?

There is no known exploitation of CVE-2022-41267 in the wild and no public exploit code.

Sources

Also known as GHSA-8v36-8jq8-23wc.