CVE-2023-28764: sap_se sap businessobjects platform Insufficiently Protected Credentials

Vulnerability summary

CVE-2023-28764 is a medium (CVSS 5.9) Insufficiently Protected Credentials vulnerability in sap_se sap businessobjects platform. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.6% of scored vulnerabilities.

Timeline

1. 09-05-2023
   PublishedVulnerability first disclosed.
2. 28-01-2025
   Last modifiedVulnerability information updated.

Description

SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This could allow an unauthenticated attacker with deep knowledge to gain sensitive information such as user credentials and domain names, which may have a low impact on confidentiality and no impact on the integrity and availability of the system.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.