CVE-2026-44755

SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users, resulting in an email spoofing vulnerability.This vulnerability has a low impact on integrity and does not affect the confidentiality and availability of the application.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3687096
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) La Plataforma SAP Business Objects Business Intelligence no valida de forma suficiente los parámetros de envío de correo electrónico suministrados por usuarios autenticados, lo que resulta en una vulnerabilidad de suplantación de identidad por correo electrónico. Esta vulnerabilidad tiene un bajo impacto en la integridad y no afecta la confidencialidad y disponibilidad de la aplicación.

09 Jun 2026, 01:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 01:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-44755

Mitre link : CVE-2026-44755

CVE.ORG link : CVE-2026-44755

JSON object : View

Products Affected

No product.

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2026-44755", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44755", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:32:35.369132Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Business Objects Business Intelligence Platform", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T01:16:47.177", "references": [{"url": "https://me.sap.com/notes/3687096", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users, resulting in an email spoofing vulnerability.This vulnerability has a low impact on integrity and does not affect the confidentiality and availability of the application."}, {"lang": "es", "value": "La Plataforma SAP Business Objects Business Intelligence no valida de forma suficiente los par\u00e1metros de env\u00edo de correo electr\u00f3nico suministrados por usuarios autenticados, lo que resulta en una vulnerabilidad de suplantaci\u00f3n de identidad por correo electr\u00f3nico. Esta vulnerabilidad tiene un bajo impacto en la integridad y no afecta la confidencialidad y disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "cna@sap.com"}