Critical severity · published Feb 15, 2019
CVE-2019-0259
SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation
9.8
CVSS
2%
EPSS
No
On KEV
Description
SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP BusinessObjects Business Intelligence Platform Servers (Enterprise) · SAP SE
< 4.2; < 4.3 · source: vendor
BU
Businessobjects · Sap
4.2; 4.3 · source: NVD
Affected product
SB
SAP BusinessObjects Business Intelligence Platform Servers (Enterprise)
SAP SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0259
Third Party Advisory
http://www.securityfocus.com/bid/106997
Permissions Required
https://launchpad.support.sap.com/#/notes/2727564
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943