Sap Businessobjects Business Intelligence vulnerabilities

CVE-2023-28765 [CRITICAL] CWE-200 CVE-2023-28765: An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion M An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can comp

CVE-2023-40622 [CRITICAL] CWE-732 CVE-2023-40622: SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, an

CVE-2018-2427 [HIGH] CWE-94 CVE-2018-2427: SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (ve SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.

CVE-2022-41203 [HIGH] CWE-502 CVE-2022-41203: In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), a In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted data vulnerability. This could highly compromise the Co

CVE-2018-2445 [CRITICAL] CWE-918 CVE-2018-2445: AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to ma AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery (SSRF) vulnerability.

CVE-2023-37490 [CRITICAL] CWE-427 CVE-2023-37490: SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the netw SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an attacker can completely compromise the confidentiality, integrity, and availability of the s

CVE-2019-0268 [HIGH] CWE-91 CVE-2019-0268: SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source.

CVE-2022-32245 [HIGH] CWE-319 CVE-2022-32245: SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an un SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network. On successful exploitation, the attacker can view any data available for a business user and put load on the application by an automated attack. Thus, completely compr

CVE-2023-36917 [HIGH] CWE-307 CVE-2023-36917: SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attack SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could

CVE-2023-28762 [HIGH] CWE-200 CVE-2023-28762: SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated atta SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate any user on the platform resulting into accessing and modifying data. The attacker can also ma

CVE-2023-30740 [HIGH] CWE-200 CVE-2023-30740: SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated atta SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact on integrity and availability of the application.

CVE-2025-23192 [HIGH] CWE-79 CVE-2025-23192: SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. Th

CVE-2018-2446 [HIGH] CVE-2018-2446: Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticate Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information (server name), hence leading to an information disclosure.

CVE-2022-28214 [HIGH] CWE-312 CVE-2022-28214: During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.

CVE-2023-27896 [HIGH] CWE-918 CVE-2023-27896: In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.

CVE-2018-2447 [MEDIUM] CWE-89 CVE-2018-2447: SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attac SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database.

CVE-2024-37179 [MEDIUM] CWE-434 CVE-2024-37179: SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.

CVE-2018-2442 [HIGH] CWE-352 CVE-2018-2442: In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelli In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid.

CVE-2019-0348 [MEDIUM] CWE-319 CVE-2019-0348: SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.

CVE-2019-0333 [MEDIUM] CVE-2019-0333: In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platf In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.