Businessobjects Business Intelligence vulnerabilities

11 known vulnerabilities in Businessobjects Business Intelligence from SAP. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  SAP BusinessObjects Business Intelligence (BI…: Improper Neutralization of Input During Web Page Generation

  CVE-2025-23192Jun 10, 2025SAP

  SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potent

• 9.9 Critical severity

  SAP BusinessObjects Business Intelligence…: Incorrect Permission Assignment for Critical Resource

  CVE-2023-40622Sep 12, 2023SAP

  SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can co

• 9.0 Critical severity

  SAP BusinessObjects Business Intelligence…: Uncontrolled Search Path Element

  CVE-2023-37490Aug 8, 2023SAP

  SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an att

• 7.5 High severity

  SAP BusinessObjects Business Intelligence…: Improper Restriction of Excessive Authentication Attempts

  CVE-2023-36917Jul 11, 2023SAP

  SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functiona

• 7.6 High severity

  SAP BusinessObjects Business Intelligence…: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2023-30740May 9, 2023SAP

  SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact

• 7.2 High severity

  SAP BusinessObjects Intelligence Platform: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2023-28762May 9, 2023SAP

  SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate a

• 9.8 Critical severity

  BusinessObjects Business Intelligence Platform…: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2023-28765Apr 11, 2023SAPEPSS 14.9%

  An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depe

• 7.5 High severity

  BusinessObjects Business Intelligence Platform…: Server-Side Request Forgery

  CVE-2023-27896Mar 14, 2023SAP

  In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.

• 8.8 High severity

  SAP BusinessObjects Business Intelligence…: Deserialization of Untrusted Data

  CVE-2022-41203Nov 8, 2022SAPEPSS 1.13%

  In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which

• 8.2 High severity

  SAP BusinessObjects Business Intelligence…: Cleartext Transmission of Sensitive Information

  CVE-2022-32245Aug 10, 2022SAP

  SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network. On successful exploitation, the attacker can view any data available for a

• 7.8 High severity

  SAP BusinessObjects Enterprise (Central…: Cleartext Storage of Sensitive Information

  CVE-2022-28214May 11, 2022SAP

  During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integ