Businessobjects Business Intelligence Platform vulnerabilities

Product

Businessobjects Business Intelligence Platform

by Sap · last CVE Feb 10, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities73 In the news0 Timeline

Severity mix

Critical 7High 20Medium 46Low 0

Severity

All severities73 Critical7 High20 Medium46 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Businessobjects Business Intelligence Platform to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2020-6278	5.4	1%	Jul 14	SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading… Affected: 4.1; 4.2
CVE-2020-6257	5.4	1%	May 12	SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability Affected: 4.2
CVE-2020-6231	5.4	1%	Apr 14	SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site… Affected: 4.2
CVE-2020-6226	5.4	1%	Apr 14	SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site… Affected: 4.2
CVE-2020-6222	5.4	1%	Apr 14	SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in… Affected: 4.1; 4.2
CVE-2020-6221	5.4	1%	Apr 14	Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in… Affected: 4.1; 4.2
CVE-2019-0395	5.4	1%	Dec 11	SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launchpad, leading to… Affected: before 4.2
CVE-2019-0382	5.4	1%	Nov 13	A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in version 4.2 Affected: before 4.2
CVE-2019-0378	5.4	1%	Oct 8	SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an… Affected: 4.0; 4.1; 4.1; 4.1; 4.1
CVE-2019-0377	5.4	1%	Oct 8	SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an… Affected: 4.0; 4.1; 4.1; 4.1; 4.1
CVE-2019-0376	5.4	1%	Oct 8	SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows… Affected: 4.0; 4.1; 4.1; 4.1; 4.1; 4.2; +3 more
CVE-2019-0375	5.4	1%	Oct 8	SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows… Affected: 4.0; 4.1; 4.1; 4.1; 4.1; 4.2; +3 more
CVE-2019-0374	5.4	1%	Oct 8	SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows… Affected: 4.0; 4.1; 4.1; 4.1; 4.1; 4.2; +3 more
CVE-2018-2397	5.4	1%	Mar 14	In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controlled inputs which… Affected: 4.00; 4.10; 4.20; 4.30
CVE-2025-42988	5.3	0%	Jun 10	Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially… Affected: 430; 2025; 2027
CVE-2024-32732	5.3	0%	Dec 10	Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on… Affected: 430; 2025
CVE-2022-39014	5.3	0%	Sep 13	Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certain unencrypted… Affected: 430
CVE-2020-6308	5.3	62%	Oct 20	SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to… Affected: 4.1; 4.2; 4.3
CVE-2020-6288	5.3	1%	Sep 9	SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files)… Affected: 4.1; 4.2
CVE-2020-6189	5.3	1%	Feb 12	Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related… Affected: 4.2
CVE-2020-6218	5.0	1%	Apr 14	Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be… Affected: 4.1; 4.2
CVE-2020-6300	4.8	1%	Aug 12	SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to… Affected: 4.2; 4.3
CVE-2024-33004	4.3	0%	May 14	SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out Affected: 430; 440