CVE-2024-37179 Insecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

High 7.7 Published 8 Oct 2024 Updated 8 Oct 2024

Authenticated attackers can download arbitrary files from the server via crafted requests to the Web Intelligence Reporting Server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-37179?

CVE-2024-37179 is a high-severity path traversal vulnerability in SAP_SE SAP BusinessObjects Business Intelligence Platform (Web Intelligence), published on 8 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.

Weakness: CWE-434

Which versions are affected by CVE-2024-37179?

It affects 1 product.

Products include Sap Businessobjects Business Intelligence.

How do I fix CVE-2024-37179?

No fix has been published for CVE-2024-37179 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-37179 being exploited?

There is no known exploitation of CVE-2024-37179 in the wild and no public exploit code.

Sources

Also known as GHSA-gc4w-ffjr-829q.