CVE-2023-28765

Katalog CVE

CVSS 9.8 · Critical EPSS 14,9%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada sap businessobjects business intelligence. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.

Rincian

Terbit di NVD

11 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

14,9% peluang dieksploitasi; lebih tinggi dari 96,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html advisory vendor
• https://launchpad.support.sap.com/#/notes/3298961 permissions required