Read the docs
TI-2019-00225 Aliases CVE-2019-0259GHSA-qxc5-v3qf-64v6

Unrestricted file upload in SAP BusinessObjects Business Intelligence Platform Servers

Priority MEDIUM 46CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.

Why it matters now

EPSS 0.02016 81st percentileScored 2026-11-07
Fix Fixed SAP BusinessObjects Business Intelligence Platform Servers (Enterprise) (SAP SE): 4.2, 4.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP BusinessObjects Business Intelligence Platform Servers (Enterprise)before 4.2; before 4.34.2, 4.3Patch availableCNA
  • SAP BusinessObjects Business Intelligence Platform Servers (Enterprise) VendorSAP Affected before 4.2; before 4.3 Fixed in 4.2, 4.3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sap:businessobjects:4.2:*:*:*:*:*:*:*4.2VulnerableSAP
cpe:2.3:a:sap:businessobjects:4.3:*:*:*:*:*:*:*4.3VulnerableSAP
  • cpe:2.3:a:sap:businessobjects:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·SAP
  • cpe:2.3:a:sap:businessobjects:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP BusinessObjects Business Intelligence Platform Servers (Enterprise) (SAP SE) Fixed in 4.2, 4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0259
  2. 2026-10-03 Alias added: GHSA-qxc5-v3qf-64v6

References

Advisory 2

  • TI-2010-00211 Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA… CVSS 2.0HIGH 10.0
  • TI-2014-07616 SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the… CVSS 2.0HIGH 10.0
  • TI-2015-06422 SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI… CVSS 2.0HIGH 10.0
  • TI-2010-03781 CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain… CVSS 2.0HIGH 9.0
  • TI-2019-00247 Under certain conditions SAP BusinessObjects Business Intelligence platform (Central… CVSS 3.0HIGH 7.6
  • TI-2014-06830 The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to… CVSS 2.0HIGH 7.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences