CVE-2024-25646 Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence
An authenticated attacker can access operating system information via a crafted document in SAP BusinessObjects Web Intelligence, compromising confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25646?
CVE-2024-25646 is a high-severity vulnerability in SAP_SE SAP BusinessObjects Web Intelligence, published on 9 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.
Weakness: CWE-732
Which versions are affected by CVE-2024-25646?
It affects 1 product.
Products include Sap Businessobjects Web Intelligence.
How do I fix CVE-2024-25646?
No fix has been published for CVE-2024-25646 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-25646 being exploited?
There is no known exploitation of CVE-2024-25646 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP BusinessObjects Web Intelligence
- CVE-2023-42476 Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence
- CVE-2023-42474 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence
- CVE-2022-22546 Cross-site scripting in SAP Business Objects Web Intelligence (BI Launchpad)
- CVE-2021-33667 Information disclosure in SAP Business Objects Web Intelligence (BI Launchpad)
Sources
Also known as GHSA-r63f-6gcw-2c47.