CVE-2024-25646

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25646
Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3421384 Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 Patch
https://me.sap.com/notes/3421384 Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:businessobjects_web_intelligence:420:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_web_intelligence:430:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_web_intelligence:440:*:*:*:*:*:*:*
History

29 Oct 2025, 14:08

Type Values Removed Values Added
CPE cpe:2.3:a:sap:businessobjects_web_intelligence:430:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_web_intelligence:420:*:*:*:*:*:*:*
cpe:2.3:a:sap:businessobjects_web_intelligence:440:*:*:*:*:*:*:*
References () https://me.sap.com/notes/3421384 - () https://me.sap.com/notes/3421384 - Permissions Required
References () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - Patch
First Time Sap businessobjects Web Intelligence
Sap

21 Nov 2024, 09:01

Type Values Removed Values Added
References () https://me.sap.com/notes/3421384 - () https://me.sap.com/notes/3421384 -
References () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 - () https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 -

28 Sep 2024, 23:15

Type Values Removed Values Added
CWE CWE-200 CWE-732
Summary (en) Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application. (en) Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.

09 Apr 2024, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-09 01:15

Updated : 2025-10-29 14:08

NVD link : CVE-2024-25646

Mitre link : CVE-2024-25646

CVE.ORG link : CVE-2024-25646

JSON object : View

Products Affected

sap

  • businessobjects_web_intelligence
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource