SAP
SAP Business Objects Business Intelligence Platform: vulnerabilidades y CVE
SAP Business Objects Business Intelligence Platform tiene 21 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE21
Últimos 12 meses2
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-44755 | Media (4.3) | 0.15% | — | 9 jun 2026 | SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users, resulting in an email spoofing vulnerability.This vulnerability has a low… |
| CVE-2026-24318 | Media (4.2) | 0.17% | — | 14 abr 2026 | Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a… |
| CVE-2025-23185 | Media (4.1) | 0.29% | — | 11 mar 2025 | Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with… |
| CVE-2024-42375 | Media (4.3) | 0.36% | — | 13 ago 2024 | — |
| CVE-2024-41731 | Media (4.3) | 0.37% | — | 13 ago 2024 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can… |
| CVE-2024-41730 | Crítica (9.8) | 76% | — | 13 ago 2024 | In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the… |
| CVE-2024-28166 | Media (4.3) | 0.34% | — | 13 ago 2024 | — |
| CVE-2023-42478 | Alta (7.6) | 0.56% | — | 12 dic 2023 | SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity… |
| CVE-2023-25617 | Alta (8.8) | 0.93% | — | 14 mar 2023 | SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the… |
| CVE-2023-25616 | Alta (8.8) | 0.95% | — | 14 mar 2023 | In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to… |
| CVE-2023-23856 | Media (5.4) | 0.34% | — | 14 feb 2023 | In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls… |
| CVE-2023-0015 | Media (5.4) | 0.34% | — | 10 ene 2023 | In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that… |
| CVE-2022-41267 | Alta (8.8) | 0.82% | — | 13 dic 2022 | SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take… |
| CVE-2022-41263 | Media (4.3) | 0.22% | — | 12 dic 2022 | Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions 420, 430, allows an authenticated non-administrator attacker to modify the data source information… |
| CVE-2022-31596 | Media (6) | 0.68% | — | 12 dic 2022 | Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intelligence Platform (Monitoring DB) - version 430, can access… |
| CVE-2022-39015 | Media (6.5) | 0.84% | — | 11 oct 2022 | Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted. |
| CVE-2022-39013 | Alta (7.6) | 0.67% | — | 11 oct 2022 | Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on… |
| CVE-2022-32246 | Media (4.6) | 0.46% | — | 12 jul 2022 | SAP Busines Objects Business Intelligence Platform (Visual Difference Application) - versions 420, 430, allows an authenticated attacker who has access to BI admin console to send crafted queries and extract data from… |
| CVE-2022-31598 | Media (5.4) | 0.24% | — | 12 jul 2022 | Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a malicious request through an allowed operation. On successful exploitation, an attacker can view or… |
| CVE-2020-6220 | Media (4.7) | 0.50% | — | 6 jun 2022 | BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Exploit is… |
| CVE-2022-24398 | Media (6.5) | 0.80% | — | 10 mar 2022 | Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which would otherwise be restricted. |
Otros productos de SAP
3D Visual Enterprise Viewer · 131Netweaver · 119Netweaver Application Server Abap · 110Businessobjects Business Intelligence Platform · 80Netweaver Application Server Java · 79S/4hana · 50Businessobjects Business Intelligence · 46Hana · 39Solution Manager · 37Business ONE · 35Abap Platform · 32Netweaver Enterprise Portal · 29