Cross-Site Scripting via Malicious File Upload in SAP Business Planning and Consolidation

SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

• SAP Business Planning and Consolidation version 740: affected.
• SAP Business Planning and Consolidation version 750: affected.
• The product's default status is recorded as unaffected for versions not explicitly listed as affected. No fixed release, release-branch boundary, or status for other branches is provided.

This is a CWE-79 Cross-Site Scripting weakness involving file upload in SAP Business Planning and Consolidation. An authorized attacker can introduce a malicious file into the application, resulting in content being handled in a way that produces XSS. The supplied attack characteristics indicate network reachability, low complexity, low privileges, and required user interaction. Scope is marked as changed, but the record does not identify the specific security boundary crossed. It also does not identify the endpoint, file type, neutralization failure, browser context, or whether the XSS is stored or reflected.

The record describes a network-reachable attack performed by an authorized attacker with low privileges and low attack complexity. User interaction is required for successful exploitation. The supplied public_exploit field is false, but known_exploited is null; therefore, the record does not establish exploitation in the wild and is not sufficient to claim that exploitation has never occurred. No campaign, victim, specific exploit, or IOC is identified.

The confirmed technical outcome is Cross-Site Scripting after an authorized attacker uploads a malicious file and the required interaction occurs. The assessed impact is limited confidentiality and integrity impact, with no identified availability impact. The supplied vector marks scope as changed, but the record does not describe the specific security boundary or privileges that could be reached. Organizationally, response may require reviewing uploaded content, access permissions, and activity by affected users; the record provides no evidence of an actual compromise or data loss.

The vulnerability can cause limited confidentiality and integrity impact to the application after successful exploitation. Depending on the interaction context and the data accessible to the affected user, possible consequences include interference with application content or actions; these are possible outcomes rather than separately confirmed details in the record. No availability impact is identified in the supplied assessment. The record does not confirm that organizational data has been accessed or modified.

1. Inventory SAP Business Planning and Consolidation systems and prioritize systems running version 740 or 750.
2. Obtain the applicable SAP correction or remediation guidance from SAP Support and apply it according to SAP instructions. The supplied data does not name a fixed release, provide solution text, or confirm patch status.
3. Until the correction is identified, temporarily minimize the set of users permitted to upload files and review upload permissions. This is a general precaution, not a vendor-confirmed workaround.
4. After remediation, verify the release and patch level and perform approved testing of the upload function using non-malicious content. Do not infer that another branch is fixed merely because an advisory exists for this issue.

1. Inventory SAP Business Planning and Consolidation systems and identify deployments running version 740 or 750.
2. Review roles and permissions that allow users to upload files, because exploitation requires an authorized account.
3. Review application and web server logs for unusual upload activity, subsequent access to uploaded content, or reports of unexpected script behavior in the BPC interface. This is precautionary monitoring, not a confirmed IOC.
4. Use SAP-approved validation or controlled security testing to determine whether the vulnerable behavior persists without deploying a malicious payload. Absence of suspicious log events does not prove that a system is safe.