SAP Business Planning And Consolidation vulnerabilities

6 CVEs affecting SAP Business Planning And Consolidation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-31407, published 2023-05-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-16349, published 2018-08-02. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in…
CVE-2023-0016, published 2023-01-10. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an…
CVE-2022-41268, published 2022-12-13. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, a transaction code reserved for the…
CVE-2020-6368, published 2020-10-15. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without…
CVE-2023-31407, published 2023-05-09. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation,…
CVE-2023-23851, published 2023-02-14. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If…