CVE-2023-28765: Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
First published: Tue Apr 11 2023(Updated: )
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP BusinessObjects Business Intelligence | =420 | |
| SAP BusinessObjects Business Intelligence | =430 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-28765?
CVE-2023-28765 is a vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 and 430 that allows an attacker with basic privileges to access lcmbiar files and decrypt them, potentially gaining access to BI user's passwords.
How severe is CVE-2023-28765?
CVE-2023-28765 has a severity rating of 9.8, which is considered critical.
What software versions are affected by CVE-2023-28765?
CVE-2023-28765 affects SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 and 430.
How can an attacker exploit CVE-2023-28765?
An attacker with basic privileges can exploit CVE-2023-28765 by accessing lcmbiar files and decrypting them, potentially gaining access to BI user's passwords.
Are there any fixes or patches available for CVE-2023-28765?
Yes, SAP has released patches and fixes for CVE-2023-28765. Please refer to the official SAP website or support portal for more information.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- vendor/sap
- canonical/sap businessobjects business intelligence
- version/sap businessobjects business intelligence/420
- version/sap businessobjects business intelligence/430