« Volver al listado

CVE-2024-28166

Estado: ModificadaMedia (4.3)—
Detalles técnicos trazas, registros y código del informe original
SAP BusinessObjects Business Intelligence
  Platform allows an authenticated attacker to upload malicious code over the
  network, that could be executed by the application. On successful
  exploitation, the attacker can cause a low impact on the Integrity of the
  application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Business Objects Business Intelligence Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-28166",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28166",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-13T13:54:04.603269Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP BusinessObjects Business Intelligence Platform",
          "versions": [
            {
              "status": "affected",
              "version": "ENTERPRISE 430"
            },
            {
              "status": "affected",
              "version": "2025"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-08-13T04:15:06.867",
  "references": [
    {
      "url": "https://me.sap.com/notes/3433545",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3515653",
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP BusinessObjects Business Intelligence\n  Platform allows an authenticated attacker to upload malicious code over the\n  network, that could be executed by the application. On successful\n  exploitation, the attacker can cause a low impact on the Integrity of the\n  application."
    },
    {
      "lang": "es",
      "value": "La plataforma SAP BusinessObjects Business Intelligence permite a un atacante autenticado cargar código malicioso a través de la red, que podría ser ejecutado por la aplicación. Si la explotación tiene éxito, el atacante puede causar un impacto bajo en la integridad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T07:21:07.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6EB0EFA3-8AD2-42F2-86E1-A62ECF8340E3"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:440:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD397634-7D49-454E-9854-0A8212008655"
            },
            {
              "criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_420:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "029BEDE8-97DB-4716-8A5D-D7CC8049B93F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}