SAP Business Connector vulnerabilities

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system.

Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.

An OS Command Injection vulnerability exists in SAP Business Connector. An authenticated attacker with administrative access and adjacent network access could upload specially crafted content that, when processed, enables execution of arbitrary operating system commands.

SAP Business Connector contains a Reflected Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can create a malicious link and make it publicly accessible. When an authenticated victim opens the link, the injected input executes in their browser.