9.8

CVE-2023-28765: Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )

Modified
Published 11-04-2023Last modified 07-02-2025

Vulnerability summary

CVE-2023-28765 is a critical (CVSS 9.8) vulnerability in sap businessobjects_business_intelligence. EPSS estimates a 14.94% chance of exploitation in the next 30 days, higher than 96.7% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
14.94%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 11-04-2023
    PublishedVulnerability first disclosed.
  2. 07-02-2025
    Last modifiedVulnerability information updated.

Description

An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

14.94%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 14.94% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Sap2 products

1 vendor · 2 products

References

2 links