CVE-2023-28762— Information Disclosure in SAP BusinessObjects Intelligence Platform
Quick assessment
Affected
SAP_SE SAP BusinessObjects Intelligence Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP BusinessObjects Business Intelligence Platform是德国思爱普（SAP）公司的一款完备的商务分析平台。该平台集市场领先的 SAP 数据整合产品、数据管理产品和商务智能 (BI) 产品于一身，可消除系统集成难题，快速、轻松地部署高性能的商务分析软件。 SAP BusinessObjects Business Intelligence Platform 420版本、430版本存在信息泄露漏洞。攻击者利用该漏洞可以冒充平台上的任何用户，从而访问和修改数据。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-28762
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure in SAP BusinessObjects Intelligence Platform
Source: CVE Program / CVE List V5
Vulnerability Description
SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate any user on the platform resulting into accessing and modifying data. The attacker can also make the system partially or entirely unavailable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
SAP BusinessObjects Business Intelligence Platform 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP BusinessObjects Business Intelligence Platform是德国思爱普（SAP）公司的一款完备的商务分析平台。该平台集市场领先的 SAP 数据整合产品、数据管理产品和商务智能 (BI) 产品于一身，可消除系统集成难题，快速、轻松地部署高性能的商务分析软件。 SAP BusinessObjects Business Intelligence Platform 420版本、430版本存在信息泄露漏洞。攻击者利用该漏洞可以冒充平台上的任何用户，从而访问和修改数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP BusinessObjects Intelligence Platform | 420 | - |
|
II. Public POCs for CVE-2023-28762
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28762
请登录查看更多情报信息。
Other References for CVE-2023-28762 (2)
Same Patch Batch · SAP_SE · 2023-05-09 · 14 CVEs total
| CVE-2023-30744 | 8.2 HIGH | Improper access control during application start-up in SAP AS NetWeaver JAVA. |
| CVE-2023-32113 | 7.5 HIGH | Information Disclosure vulnerability in SAP GUI for Windows |
| CVE-2023-32111 | 7.5 HIGH | Memory Corruption vulnerability in SAP PowerDesigner (Proxy) |
| CVE-2023-30743 | 7.1 HIGH | Improper Neutralization of Input in SAPUI5 |
| CVE-2023-30740 | 6.3 MEDIUM | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform |
| CVE-2023-31406 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Plat |
| CVE-2023-30742 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) |
| CVE-2023-30741 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Plat |
| CVE-2023-31407 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation |
| CVE-2023-29188 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI |
| CVE-2023-31404 | 5.0 MEDIUM | Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Mana |
| CVE-2023-28764 | 3.7 LOW | Information Disclosure vulnerability in SAP BusinessObjects Platform |
| CVE-2023-32112 | 2.8 LOW | Missing Authorization Check in Vendor Master Hierarchy |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-200
-
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Informatio -
CVE-2026-47514
NVIDIA驱动内核栈信息泄露漏洞 -
CVE-2026-102845
gedelumbung HospitalManagement HTTP Response index.php error -
CVE-2026-90441
Fireware OS Missing Authorization in wgagent Management API -
CVE-2026-102709
Arm TrustZone-M NS指针校验漏洞
V. Comments for CVE-2023-28762
No comments yet