TI-2023-13274 Aliases CVE-2023-28764 GHSA-33w9-vc3g-2mjp

Information Disclosure vulnerability in SAP BusinessObjects Platform

LOW 27CWE-522Published 2023-05-09 · Updated 2025-01-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This could allow an unauthenticated attacker with deep knowledge to gain sensitive information such as user credentials and domain names, which may have a low impact on confidentiality and no impact on the integrity and availability of the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0051 43rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP BusinessObjects Platform	420; 430	—	No fix listed	CNA

SAP BusinessObjects Platform VendorSAP Affected 420; 430 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:businessobjects:4.20:::::::*	4.20	Vulnerable	SAP
cpe:2.3:a:sap:businessobjects:4.30:::::::*	4.30	Vulnerable	SAP

cpe:2.3:a:sap:businessobjects:4.20:*:*:*:*:*:*:* Versions 4.20 Vulnerable ·SAP
cpe:2.3:a:sap:businessobjects:4.30:*:*:*:*:*:*:* Versions 4.30 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-28764
2026-10-03 Alias added: GHSA-33w9-vc3g-2mjp

References

Advisory 1

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Other 1

https://i7p.wdf.sap.corp/sap/support/notes/3302595

TI-2010-00211 Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA… CVSS 2.0HIGH 10.0
TI-2014-07616 SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the… CVSS 2.0HIGH 10.0
TI-2015-06422 SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI… CVSS 2.0HIGH 10.0
TI-2019-00225 Unrestricted file upload in SAP BusinessObjects Business Intelligence Platform Servers CVSS 3.0CRITICAL 9.8
TI-2010-03781 CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain… CVSS 2.0HIGH 9.0
TI-2019-00247 Under certain conditions SAP BusinessObjects Business Intelligence platform (Central… CVSS 3.0HIGH 7.6

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences