SAP BusinessObjects Business Intelligence Platform HTML Injection Vulnerability (3573199)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(241997);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/11");

  script_cve_id("CVE-2025-31326");

  script_name(english:"SAP BusinessObjects Business Intelligence Platform HTML Injection Vulnerability (3573199)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of SAP BusinessObjects Business Intelligence Platform installed on the remote host is prior to 2025 SP000
000200, 4.3 SP004 001300, or 4.3 SP005 000000. It is, therefore, affected by a vulnerability as referenced in the 3573199
advisory. An HTML Injection exists which allows an attacker with basic user privileges to inject malicious code into
specific input fields. This could lead to unintended redirects or manipulation of application behavior.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://launchpad.support.sap.com/#/notes/3573199");
  script_set_attribute(attribute:"solution", value:
"Upgrade to SAP BusinessObjects Business Intelligence Platform version 2027 SP000 000000 / 2025 SP000 000200 / 4.3 SP004
001300 / 4.3 SP005 000000 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-31326");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sap:businessobjects_business_intelligence_platform");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sap_business_objects_intelligence_platform_win_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/SAP BusinessObjects Business Intelligence Platform");

  exit(0);
}

include('vcf.inc');
get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::get_app_info(app:'SAP BusinessObjects Business Intelligence Platform', win_local:TRUE);

var constraints = [
  { 'min_version' : '14.3.4', 'fixed_version' : '14.3.4.9999', 'fixed_display' : '4.3 SP004 001300', 'require_paranoia': TRUE},
  { 'min_version' : '14.3.5', 'fixed_version' : '14.3.5.9999', 'fixed_display' : '4.3 SP005 000000', 'require_paranoia': TRUE},
  { 'min_version' : '15.0.0', 'fixed_version' : '15.0.0.9999', 'fixed_display' : '2025 SP000 000200', 'require_paranoia': TRUE}
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);