SAP
SAP Businessobjects Business Intelligence: vulnerabilidades y CVE
SAP Businessobjects Business Intelligence tiene 46 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE46
Últimos 12 meses1
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-27683 | Media (4.1) | 0.28% | — | 14 abr 2026 | SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a victim accesses the URL, the script executes in the user�s… |
| CVE-2025-23192 | Alta (7.6) | 0.36% | — | 10 jun 2025 | SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in… |
| CVE-2024-37179 | Media (6.5) | 0.43% | — | 8 oct 2024 | SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service,… |
| CVE-2023-40622 | Crítica (9.9) | 0.65% | — | 12 sept 2023 | SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On… |
| CVE-2023-37489 | Media (5.3) | 0.52% | — | 12 sept 2023 | Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low… |
| CVE-2023-39440 | Media (4.4) | 0.12% | — | 8 ago 2023 | In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to… |
| CVE-2023-37490 | Crítica (9) | 0.27% | — | 8 ago 2023 | SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this… |
| CVE-2023-36917 | Alta (7.5) | 0.58% | — | 11 jul 2023 | SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted… |
| CVE-2023-31406 | Media (6.1) | 0.46% | — | 9 may 2023 | Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful… |
| CVE-2023-31404 | Media (5) | 0.47% | — | 9 may 2023 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users… |
| CVE-2023-30741 | Media (6.1) | 0.39% | — | 9 may 2023 | Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful… |
| CVE-2023-30740 | Alta (7.6) | 0.46% | — | 9 may 2023 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high… |
| CVE-2023-28762 | Alta (7.2) | 0.71% | — | 9 may 2023 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user… |
| CVE-2023-28765 | Crítica (9.8) | 15% | — | 11 abr 2023 | An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can… |
| CVE-2023-27896 | Alta (7.5) | 0.52% | — | 14 mar 2023 | In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on… |
| CVE-2023-27894 | Media (5.3) | 0.62% | — | 14 mar 2023 | SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not… |
| CVE-2022-41203 | Alta (8.8) | 0.99% | — | 8 nov 2022 | In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with… |
| CVE-2022-41206 | Media (5.4) | 0.53% | — | 11 oct 2022 | SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-controlled inputs when OLAP connections are created and edited in the Central… |
| CVE-2022-39800 | Media (6.1) | 0.65% | — | 11 oct 2022 | SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the network. On… |
| CVE-2022-35296 | Media (4.9) | 0.83% | — | 11 oct 2022 | Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network with high privileges that is not… |
| CVE-2022-32244 | Media (5.2) | 0.46% | — | 13 sept 2022 | Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify system data but can't make the system unavailable. This needs… |
| CVE-2022-32245 | Alta (8.2) | 0.52% | — | 10 ago 2022 | SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network. On successful exploitation, the… |
| CVE-2022-28214 | Alta (7.8) | 0.17% | — | 11 may 2022 | During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high… |
| CVE-2021-33697 | Media (6.1) | 0.58% | — | 15 sept 2021 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing… |
| CVE-2021-33696 | Media (5.4) | 0.47% | — | 15 sept 2021 | SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an authorized attacker can exploit a XSS vulnerability, leading… |
| CVE-2021-21444 | Media (6.1) | 0.81% | — | 9 feb 2021 | SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result,… |
| CVE-2021-21447 | Media (5.4) | 0.53% | — | 12 ene 2021 | SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed… |
| CVE-2019-0348 | Media (6.5) | 0.69% | — | 14 ago 2019 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted. |
| CVE-2019-0346 | Media (6.5) | 0.69% | — | 14 ago 2019 | Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI… |
| CVE-2019-0335 | Media (6.1) | 0.81% | — | 14 ago 2019 | Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user… |
Otros productos de SAP
3D Visual Enterprise Viewer · 131Netweaver · 119Netweaver Application Server Abap · 110Businessobjects Business Intelligence Platform · 80Netweaver Application Server Java · 79S/4hana · 50Hana · 39Solution Manager · 37Business ONE · 35Abap Platform · 32Netweaver Enterprise Portal · 29Internet Graphics Server · 28