CVE-2023-28765: Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-28765?
CVE-2023-28765 is a vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 and 430 that allows an attacker with basic privileges to access lcmbiar files and decrypt them, potentially gaining access to BI user's passwords.
How severe is CVE-2023-28765?
CVE-2023-28765 has a severity rating of 9.8, which is considered critical.
What software versions are affected by CVE-2023-28765?
CVE-2023-28765 affects SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 and 430.
How can an attacker exploit CVE-2023-28765?
An attacker with basic privileges can exploit CVE-2023-28765 by accessing lcmbiar files and decrypting them, potentially gaining access to BI user's passwords.
Are there any fixes or patches available for CVE-2023-28765?
Yes, SAP has released patches and fixes for CVE-2023-28765. Please refer to the official SAP website or support portal for more information.