CVE-2023-28762: Exposure of Sensitive Information to an Unauthorized Actor

SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate any user on the platform resulting int...

PT-2023-23299 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Central Management Service versions 420, 430 Description: The issue allows an attacker to access restricted information under certain conditions. Some users with specific privileges could hav...

CVE-2023-31406: Improper Neutralization of Input During Web Page Generation

Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited...

SAP BusinessObjects Business Intelligence Platform 信息泄露漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...

CVE-2023-28764: Insufficiently Protected Credentials

SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This could allow an unauthenticated attacker with deep knowledge to gain sensitive information such as user credentials and domain names, which...

CVE-2023-30740: Exposure of Sensitive Information to an Unauthorized Actor

SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact on integrity and availability of the...

CVE-2023-30741: Improper Neutralization of Input During Web Page Generation

Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited...

PT-2023-22944 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform versions 420, 430 Description: The issue allows an authenticated attacker to access sensitive information that is otherwise restricted. Successful exploitation could have a high impact on...

PT-2023-23300 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform versions 420, 430 Description: The issue is caused by insufficient input validation, allowing an unauthenticated attacker to redirect users to an untrusted site using a malicious link...

CVE-2023-28765

An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user,...

CVE-2023-28765 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )

An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user,...

CVE-2023-28765

CVE-2023-28765 concerns SAP BusinessObjects Business Intelligence Platform (Promotion Management) prior to patch versions; specifically 420 and 430. The root cause involves handling of the internal file lcmbiar , enabling a basic-privilege attacker to access and decrypt the file, potentially expo...

CVE-2023-28765 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )

An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user,...

SAP BusinessObjects Business Intelligence Platform 信息泄露漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. A security vulnerability exists in SAP BusinessObjects Business Intelligence Platform lcmbiar file handling, which can be exploited by a remote attacker to submit a special request that could...

CVE-2023-28765: Exposure of Sensitive Information to an Unauthorized Actor

An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user,...

PT-2023-21947 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Promotion Management versions 420, 430 Description: An attacker with basic privileges can access the lcmbiar file and decrypt it, potentially gaining access to BI user passwords. Depending on...

SAP BusinessObjects Business Intelligence Platform Information Leakage Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. An information disclosure vulnerability exists in SAP BusinessObjects...

SAP BusinessObjects Business Intelligence Platform Code Injection (3245526)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a code injection vulnerability. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number...

SAP BusinessObjects Business Intelligence Platform Multiple Vulnerabilities (3287120)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a multiple vulnerabilities: - SSRF, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools CVE-2023-27271 - SSRF, n attack...

CVE-2023-27894

SAP BusinessObjects Business Intelligence Platform Web Services - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal...