CVE-2023-23851
Last modified
CVE-2023-23851 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system. . EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Business Planning And Consolidation | 200 |
| Sap | Business Planning And Consolidation | 300 |
References
- https://launchpad.support.sap.com/#/notes/3275841Permissions Required, Vendor Advisory
- https://launchpad.support.sap.com/#/notes/3275841Permissions Required, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-23851?
How severe is CVE-2023-23851?
How do I fix CVE-2023-23851?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-23846Due to insufficient length validation in the Open5GS GTP lib…7.5
- CVE-2023-23847A cross-site request forgery (CSRF) vulnerability in Synopsy…3.5
- CVE-2023-23848Missing permission checks in Synopsys Jenkins Coverity Plugi…4.3
- CVE-2023-23849Versions of Coverity Connect prior to 2022.12.0 are vulnerab…6.1
- CVE-2023-2385A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8
- CVE-2023-23850A missing permission check in Synopsys Jenkins Coverity Plug…4.3
- CVE-2023-23852SAP Solution Manager (System Monitoring) - version 720, does…6.1
- CVE-2023-23853An unauthenticated attacker in AP NetWeaver Application Serv…6.1
- CVE-2023-23854SAP NetWeaver Application Server for ABAP and ABAP Platform …5.4
- CVE-2023-23855SAP Solution Manager - version 720, allows an authenticated …5.4
- CVE-2023-23856In SAP BusinessObjects Business Intelligence (Web Intelligen…5.4
- CVE-2023-23857Due to missing authentication check, SAP NetWeaver AS for Ja…8.6
Are you affected by CVE-2023-23851?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST