What is CVE-2023-28762?

CVE-2023-28762 is a critical-severity vulnerability in SAP Businessobjects Business Intelligence, classified under Information Disclosure. CVSS score: 9.1/10. Published 2023-05-09.

How severe is CVE-2023-28762?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Information disclosure in SAP Businessobjects Business Intelligence

CVE-2023-28762

SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate any user on the platform resulting into accessing and modifying data. The attacker can also make the system partially or entirely unavailable.

Vulnerability class: Information Disclosure

EPSS: 0.007 (49.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Sap Businessobjects_business_intelligence — versions 420, 430
Sap_se Sap Businessobjects Intelligence Platform — versions 420, 430

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-28762?: CVE-2023-28762 is a critical-severity vulnerability in SAP Businessobjects Business Intelligence, classified under Information Disclosure. CVSS score: 9.1/10. Published 2023-05-09.
How severe is CVE-2023-28762?: Critical severity. CVSS v3 base score is 9.1 out of 10.