CVE-2023-39440— Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform
Quick assessment
Affected
SAP_SE SAP BusinessObjects Business Intelligence
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP BusinessObjects Business Intelligence Suite是德国思爱普（SAP）公司的一套商业智能软件和企业绩效解决方案套件。该产品具有报告生成、分析和数据可视化等功能。 SAP BusinessObjects Business Intelligence 存在信息泄露漏洞，该漏洞源于如果用户登录到特定程序，在某些特定条件下，内存可能无法正确清除，因此攻击者可能能够访问用户凭据。
Possible ATT&CK Techniques 1 AI
T1552.001 · Credentials In Files
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-39440
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform
Source: CVE Program / CVE List V5
Vulnerability Description
In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to have local access to the system. There is no impact on availability and integrity.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5
Vulnerability Title
SAP BusinessObjects Business Intelligence 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP BusinessObjects Business Intelligence Suite是德国思爱普（SAP）公司的一套商业智能软件和企业绩效解决方案套件。该产品具有报告生成、分析和数据可视化等功能。 SAP BusinessObjects Business Intelligence 存在信息泄露漏洞，该漏洞源于如果用户登录到特定程序，在某些特定条件下，内存可能无法正确清除，因此攻击者可能能够访问用户凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP BusinessObjects Business Intelligence | 430 | - |
|
II. Public POCs for CVE-2023-39440
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-39440
请登录查看更多情报信息。
Other References for CVE-2023-39440 (1)
Same Patch Batch · SAP_SE · 2023-08-08 · 15 CVEs total
| CVE-2023-37483 | 9.8 CRITICAL | Improper Access Control Vulnerabilities in SAP PowerDesigner |
| CVE-2023-39439 | 8.8 HIGH | SAP Commerce accepts empty passphrases. |
| CVE-2023-36923 | 7.8 HIGH | Code Injection vulnerability in SAP PowerDesigner |
| CVE-2023-39437 | 7.6 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP Business One |
| CVE-2023-37490 | 7.6 HIGH | Binary hijack in SAP BusinessObjects Business Intelligence (Installer) |
| CVE-2023-37491 | 7.5 HIGH | Improper Authorization check vulnerability in SAP Message Server |
| CVE-2023-33993 | 7.1 HIGH | SQL Injection vulnerability in SAP Business One B1i Layer |
| CVE-2023-37488 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration |
| CVE-2023-37486 | 5.9 MEDIUM | Information Disclosure vulnerability in SAP Commerce (OCC API) |
| CVE-2023-39436 | 5.8 MEDIUM | Information Disclosure in SAP Supplier Relationship Management |
| CVE-2023-37487 | 5.3 MEDIUM | Security misconfiguration vulnerability in SAP Business One (Service Layer) |
| CVE-2023-37484 | 5.3 MEDIUM | Information Disclosure Vulnerabilities in SAP PowerDesigner |
| CVE-2023-37492 | 4.9 MEDIUM | Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform |
| CVE-2023-36926 | 3.7 LOW | Information disclosure vulnerability in SAP Host Agent |
IV. Related Vulnerabilities
Same product: SAP BusinessObjects Business Intelligence
Same vendor: SAP_SE
-
CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapt -
CVE-2026-66779
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66776
Multiple vulnerabilities in SAP Business AI Platform (Approu
Same weakness: CWE-312
-
CVE-2026-59657
Apache CloudStack: Sensitive Information Disclosure via Clea -
CVE-2026-76405
Information Disclosure through Cleartext Storage in the App -
CVE-2026-76386
Information Disclosure through Action Parameters in Zoom app -
CVE-2026-76384
Information Disclosure through Action Parameters in Splunk A -
CVE-2026-76385
Information Disclosure through Action Parameters in Venafi a
V. Comments for CVE-2023-39440
No comments yet