CVE-2023-28765

critical · 9.8

An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.

9.8

CVSS

14.9%

EPSS (exploit prob.)

97th

EPSS percentile

2023-04-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-200

Affected products

Vendor	Product	Affected versions
sap	businessobjects_business_intelligence	420
sap	businessobjects_business_intelligence	430

Check a specific version with /api/v1/cve/match.

References

https://launchpad.support.sap.com/#/notes/3298961
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
https://launchpad.support.sap.com/#/notes/3298961
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-28765