Design/Logic Flaw

Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted...

Path traversal

SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service...

CVE-2022-35228

SAP BusinessObjects Central Management Console (CMC) is affected by CVE-2022-35228. The issue allows an unauthenticated attacker to retrieve token information over the network under conditions where a legitimate user accesses the application and a local compromise (e.g., sniffing or social engine...

CVE-2022-35228

SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successfu...

CVE-2022-35169

SAP BusinessObjects Business Intelligence Platform (LCM) versions 420 and 430 are affected by CVE-2022-35169, where an administrator can read and decrypt the LCMBIAR file password under certain conditions. This could lead to password modification or importing the file into another system, with hi...

CVE-2022-31591

CVE-2022-31591 affects SAP BusinessObjects BW Publisher Service versions 420 and 430. The root cause is a search path containing an unquoted element, enabling a local attacker to gain elevated privileges by placing an executable in the service’s path. The Red Hat, CNVD, and CVE records corroborat...

CVE-2022-31591

SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service...

CVE-2022-29619

Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted...

CVE-2022-29619

SAP BusinessObjects Business Intelligence Platform (4.x; v4.2.0 and v4.3.0) contains an authorization flaw where an Administrator can view, edit or modify rights of objects it does not own and that would normally be restricted. Root cause: incorrect access control for object rights, enabling priv...

SAP BusinessObjects Business Intelligence Platform 信息泄露漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP Germany. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

Authentication flaw

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

CVE-2022-28214 affects SAP BusinessObjects Enterprise CMS (versions 420 and 430). During an update, authentication credentials are exposed in Sysmon event logs, causing Information Disclosure with high impact to Confidentiality, Integrity, and Availability. The NVD/NVD-derived metrics list CVSSv3...

SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE) Vulnerability

Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity XXE Google Dork: N/A Exploit Author: West Shepherd Vendor Homepage: https://www.sap.com/ Software Link: https://www.sap.com/ Version: 4.2 and 4.3 Tested on: Windows Server 2019 x64 CVE : CVE-2022-28213 References:...

SAP BusinessObjects Intelligence 4.3 XML Injection

Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity XXE Google Dork: N/A Date: 4/21/2022 Exploit Author: West Shepherd Vendor Homepage: https://www.sap.com/ Software Link: https://www.sap.com/ Version: 4.2 and 4.3 Tested on: Windows Server 2019 x64 CVE : CVE-2022-28213...

SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)

Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity XXE Google Dork: N/A Date: 4/21/2022 Exploit Author: West Shepherd Vendor Homepage: https://www.sap.com/ Software Link: https://www.sap.com/ Version: 4.2 and 4.3 Tested on: Windows Server 2019 x64 CVE : CVE-2022-28213...

PT-2022-3938 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform version 4.x - versions 4.20, 4.30 Description: The issue is related to incorrect authorization in the SAP BusinessObjects Business Intelligence Platform. Under certain conditions, it allows a...