CVE-2026-58248

{
  "id": "CVE-2026-58248",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T01:17:22.633",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability."
    },
    {
      "lang": "es",
      "value": "SAP BusinessObjects Business Intelligence Platform (Web Intelligence) permite a un atacante con pocos privilegios subir un archivo de hoja de cálculo especialmente diseñado que contiene referencias externas maliciosas. Cuando el archivo se procesa como una fuente de datos, el componente afectado resuelve estas referencias y expone el contenido de archivos sensibles del lado del servidor dentro del informe resultante. Esto resulta en un alto impacto en la confidencialidad, sin impacto en la integridad y la disponibilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP BusinessObjects Business Intelligence",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "ENTERPRISE 430",
              "status": "affected"
            },
            {
              "version": "2025",
              "status": "affected"
            },
            {
              "version": "2027",
              "status": "affected"
            },
            {
              "version": "ENTERPRISECLIENTTOOLS 430",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T13:17:34.335693Z",
          "id": "CVE-2026-58248",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3753141",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}