SAP SE SAP Businessobjects Business Intelligence Platform vulnerabilities

31 vulnerabilities

Known vulnerabilities in SAP SE SAP Businessobjects Business Intelligence Platform, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.4MediumCVE-2021-42061sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformSAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.EPSS0.47%5.4MediumCVE-2025-42896sap_se · sap businessobjects business intelligence platformServer-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence PlatformSAP BusinessObjects Business Intelligence Platform lets an unauthenticated remote attacker send crafted requests through the URL parameter that controls the login page error message. This can cause the server to fetch attacker-supplied URLs, resulting in low impact to confidentiality and integrity, and no impact to availability.EPSS0.32%9.1CriticalCVE-2025-0061sap_se · sap businessobjects business intelligence platform +1 moreMultiple vulnerabilities in SAP BusinessObjects Business Intelligence PlatformSAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.EPSS0.49%6.5MediumCVE-2025-0060sap_se · sap businessobjects business intelligence platform +1 moreMultiple vulnerabilities in SAP BusinessObjects Business Intelligence PlatformSAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.EPSS0.41%4.7MediumCVE-2025-0062sap_se · sap businessobjects business intelligence platformCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availability. This vulnerability occurs only when script/html execution is enabled by the administrator in Central Management Console.EPSS0.28%7.1HighCVE-2025-31332sap_se · sap businessobjects business intelligence platform +1 moreInsecure File permissions vulnerability in SAP BusinessObjects Business Intelligence PlatformDue to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity and availability. However, this vulnerability does not disclose any sensitive data.EPSS0.15%6.5MediumCVE-2020-6251sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformUnder certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted.EPSS0.78%5.4MediumCVE-2020-6221sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformWeb Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.EPSS0.65%6.5MediumCVE-2022-29619sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformUnder certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted.EPSS0.90%7.5HighCVE-2022-27667sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformUnder certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.EPSS1.36%6.5MediumCVE-2022-27671sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformA CSRF token visible in the URL may possibly lead to information disclosure vulnerability.EPSS1.29%6.5MediumCVE-2022-22541sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformSAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of company data to people that shouldn't or don't need to have access.EPSS0.79%8.1HighCVE-2022-28213sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformWhen a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.EPSS12.48%9.8CriticalCVE-2024-41730sap_se · sap businessobjects business intelligence platform +1 moreMissing Authentication check in SAP BusinessObjects Business Intelligence PlatformIn SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.EPSS75.87%4.3MediumCVE-2024-41731sap_se · sap businessobjects business intelligence platform +1 moreMultiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence PlatformSAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.EPSS0.37%4.3MediumCVE-2024-42375sap_se · sap businessobjects business intelligence platform +1 moreMultiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence PlatformSAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.EPSS0.36%5.8MediumCVE-2024-45281sap_se · sap businessobjects business intelligence platform +1 moreDLL hijacking vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable system to perform DLL related tasks. This could result in a high impact on confidentiality and integrity of the application.EPSS0.16%9.3CriticalCVE-2024-28165sap_se · sap businessobjects business intelligence platform +1 moreCross site scripting vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the applicationEPSS0.56%4.3MediumCVE-2024-28166sap_se · sap businessobjects business intelligence platform +1 moreMultiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence PlatformSAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.EPSS0.34%5.3MediumCVE-2024-32732sap_se · sap businessobjects business intelligence platform +1 moreInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence platformUnder certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on Confidentiality with no impact on Integrity and Availability of the application.EPSS0.32%