description: SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.
problem types: CWE-99
affected:
{
product: SAP Business Objects Business Intelligence Platform
vendor: SAP SE
versions:
status: affected, version: < 4.2
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]