PT-2023-21947 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2023-04-11 · Updated 2023-04-14 · CVE-2023-28765

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420, 430

Description An attacker with basic privileges can access the lcmbiar file and decrypt it, potentially gaining access to BI user passwords. Depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.

Recommendations For versions 420 and 430, consider restricting access to the lcmbiar file as a temporary workaround until a patch is available. Additionally, review and limit the privileges of BI users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-28765

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 8

• https://osv.dev/vulnerability/CVE-2023-28765 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28765 · Security Note
• https://launchpad.support.sap.com/#/notes/3298961 · Note
• https://t.me/pentestingnews/34901 · Telegram Post
• https://t.me/cibsecurity/61822 · Telegram Post
• https://t.me/cvenotify/47970 · Telegram Post
• https://t.me/true_secator/4281 · Telegram Post