CVE-2024-25646

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25646

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

D

ue to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.

References
Link Resource
https://me.sap.com/notes/3421384 Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 Patch
https://me.sap.com/notes/3421384 Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:businessobjects_web_intelligence:420:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_web_intelligence:430:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_web_intelligence:440:*:*:*:*:*:*:*
History

29 Oct 2025, 14:08

Type Values Removed Values Added
First Time Sap
Sap businessobjects Web Intelligence
CPE cpe:2.3:a:sap:businessobjects_web_intelligence:440:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_web_intelligence:420:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_web_intelligence:430:*:*:*:*:*:*:*
References () https://me.sap.com/notes/3421384 - () https://me.sap.com/notes/3421384 - Permissions Required
References () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - Patch

21 Nov 2024, 09:01

Type Values Removed Values Added
References () https://me.sap.com/notes/3421384 - () https://me.sap.com/notes/3421384 -
References () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 -

28 Sep 2024, 23:15

Type Values Removed Values Added
CWE CWE-200 CWE-732
Summary (en) Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application. (en) Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.
Information

Published : 2024-04-09 01:15

Updated : 2025-10-29 14:08

NVD link : CVE-2024-25646

Mitre link : CVE-2024-25646

CVE.ORG link : CVE-2024-25646

JSON object : View

Products Affected

sap

CWE
CWE-732

Incorrect Permission Assignment for Critical Resource