CVE-2024-25646: 
SAP BusinessObjects Web Intelligence vulnerability analysis and mitigation

SAP BusinessObject Business Intelligence Launch Pad contains a vulnerability (CVE-2024-25646) that allows an authenticated attacker to access operating system information using a crafted document. The vulnerability was disclosed on April 8, 2024, and is caused by improper validation in the application (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.7 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The attack requires network access and low privilege level, with no user interaction needed (NVD).

On successful exploitation, there could be a considerable impact on the confidentiality of the application, as attackers can gain access to operating system information. The vulnerability affects the confidentiality of data while integrity and availability remain unaffected (NVD).

The vulnerability requires an authenticated user with low privileges to exploit. The attack complexity is low, and no user interaction is needed for exploitation. The attack vector is network-based, indicating the vulnerability can be exploited remotely (NVD).

SAP has released security patches to address this vulnerability. Users are advised to apply the latest security updates available through SAP's security notes (SAP Security).