BusinessObjects Business Intelligence Platform vulnerabilities
15 known vulnerabilities in BusinessObjects Business Intelligence Platform from SAP. 15 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
SAP BusinessObjects Business Intelligence…: URL Redirection to Untrusted Site
The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated r
- 7.5 High severity
SAP BusinessObjects BI Platform: Missing Authorization
SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on
- 7.5 High severity
SAP BusinessObjects BI Platform: Asymmetric Resource Consumption (Amplification)
SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a
- 7.1 High severity
SAP BusinessObjects Business Intelligence…: Insecure Inherited Permissions
Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity an
- 9.1 Critical severity
SAP BusinessObjects Business Intelligence…: Exposure of Sensitive System Information to an Unauthorized Control Sphere
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the
- 9.3 Critical severity
SAP BusinessObjects Business Intelligence…: Improper Neutralization of Input During Web Page Generation
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application
- 7.3 High severity
SAP BusinessObjects Business Intelligence…: Unrestricted Upload of File with Dangerous Type
Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image f
- 7.5 High severity
BusinessObjects Business Intelligence Platform…: Server-Side Request Forgery
In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability.
- 9.1 Critical severity
BusinessObjects Business Intelligence Platform…: Unrestricted Upload of File with Dangerous Type
SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that
- 7.1 High severity
SAP BusinessObjects Business Intelligence…: Exposure of Sensitive Information to an Unauthorized Actor
SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impa
- 8.8 High severity
BusinessObjects Business Intelligence platform…: Improper Control of Generation of Code
SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may comp
- 8.8 High severity
BusinessObjects Business Intelligence Platform: Unrestricted Upload of File with Dangerous Type
SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the system causing a hig
- 8.8 High severity
SAP BusinessObjects Business Intelligence…: Cross-Site Request Forgery
SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffin
- 8.1 High severity
SAP BusinessObjects Business Intelligence…: Missing XML Validation
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server
- 7.5 High severity
SAP BusinessObjects Business Intelligence…: Exposure of Sensitive Information to an Unauthorized Actor
Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.