Sap Businessobjects Business Intelligence Platform vulnerabilities
74 vulnerabilities
Known vulnerabilities in Sap Businessobjects Business Intelligence Platform, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-2471sapbusinessobjects_business_intelligence_platform+1
EPSS score1.73%
Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an attacker to access information which would otherwise be restricted.CVE-2018-2397sap_sesap business objects business intelligence platform+1EPSS score0.92%
In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controlled inputs which results in Cross-Site Scripting.CVE-2021-40500sap sesap businessobjects business intelligence platform (crystal reports)+1EPSS score1.30%
SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can enable the attacker to retrieve arbitrary files from the server.CVE-2021-42061sap_sesap businessobjects business intelligence platform+1EPSS score0.47%
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.CVE-2021-33679sap sesap businessobjects business intelligence platform (bi workspace)+1EPSS score0.47%
The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence allowing the attacker to compromise their confidentiality and integrity.CVE-2025-42988sap_sesap business objects business intelligence platform+1EPSS score0.25%
Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and availability of the application.CVE-2025-0061sap_sesap businessobjects business intelligence platform+1EPSS score0.49%
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.CVE-2025-0060sap_sesap businessobjects business intelligence platform+1EPSS score0.41%
SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.CVE-2025-0064sap sesap businessobjects business intelligence platform (central management console)+1EPSS score0.38%
Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability.CVE-2025-31332sap_sesap businessobjects business intelligence platform+1EPSS score0.15%
Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity and availability. However, this vulnerability does not disclose any sensitive data.CVE-2025-25245sap sesap businessobjects business intelligence platform (web intelligence)+1EPSS score0.24%
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availability.CVE-2020-26831sap sesap businessobjects bi platform (crystal report)+1EPSS score1.08%
SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).CVE-2020-6242sap sesap business objects business intelligence platform (live data connect)+1EPSS score0.84%
SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.CVE-2020-6223sap_sesap business objects business intelligence platform+1EPSS score0.66%
The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content. This can misdirect a user who is tricked into accessing these error pages rendered by the application, leading to Content Spoofing.CVE-2020-6294sap_sesap business objects business intelligence platform+1EPSS score1.53%
Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity.CVE-2020-6218sap_sesap business objects business intelligence platform+1EPSS score0.91%
Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be restricted, leading to Information Disclosure.CVE-2020-6226sap sesap business objects business intelligence platform (web intelligence html interface)+1EPSS score0.65%
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2020-6251sap_sesap businessobjects business intelligence platform+1EPSS score0.78%
Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted.CVE-2020-6276sap sesap business objects business intelligence platform (bipodata)+1EPSS score0.65%
SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability.CVE-2020-6189sap sesap business objects business intelligence platform (cmc)+1EPSS score0.88%
Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure.