Businessobjects Business Intelligence vulnerabilities

Product

Businessobjects Business Intelligence

by Sap · last CVE Jun 10, 2025

CVEs

On KEV

9.9

Max CVSS

New 30D

Vulnerabilities45 In the news0 Timeline

Severity mix

Critical 4High 12Medium 29Low 0

Severity

All severities45 Critical4 High12 Medium29 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Businessobjects Business Intelligence to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-37179	6.5	0%	Oct 8	SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file… Affected: 420; 430; 2025
CVE-2019-0348	6.5	1%	Aug 14	SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should… Affected: 4.1; 4.2
CVE-2019-0346	6.5	1%	Aug 14	Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and… Affected: 4.2
CVE-2019-0333	6.5	1%	Aug 14	In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and… Affected: 4.2
CVE-2018-2473	6.5	2%	Nov 13	SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker to prevent… Affected: 4.1; 4.2
CVE-2018-2447	6.5	1%	Aug 14	SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects… Affected: 4.2
CVE-2023-31406	6.1	0%	May 9	Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted… Affected: 420; 430
CVE-2023-30741	6.1	0%	May 9	Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted… Affected: 420; 430
CVE-2022-39800	6.1	1%	Oct 11	SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs… Affected: 420; 430
CVE-2021-33697	6.1	1%	Sep 15	Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious… Affected: 420; 430
CVE-2021-21444	6.1	1%	Feb 9	SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all… Affected: 410; 420; 430
CVE-2019-0335	6.1	1%	Aug 14	Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload… Affected: 4.1; 4.2; 4.3
CVE-2019-0332	6.1	1%	Aug 14	SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed… Affected: 4.1; 4.2; 4.3
CVE-2019-0326	6.1	1%	Jul 10	SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in… Affected: 4.1; 4.2; 4.3
CVE-2018-2431	6.1	1%	Jul 10	SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability Affected: 4.10; 4.20
CVE-2022-41206	5.4	1%	Oct 11	SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-controlled inputs when OLAP connections… Affected: 420; 430
CVE-2021-33696	5.4	0%	Sep 15	SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an authorized attacker… Affected: 420; 430
CVE-2021-21447	5.4	1%	Jan 12	SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of… Affected: 410; 420
CVE-2019-0334	5.4	1%	Aug 14	When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed… Affected: 4.1; 4.2; 4.3
CVE-2019-0269	5.4	1%	Mar 12	SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting… Affected: 4.10; 4.20
CVE-2018-2432	5.4	1%	Jul 10	SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP… Affected: 4.1; 4.2; 4.3
CVE-2023-37489	5.3	1%	Sep 12	Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code… Affected: 430
CVE-2023-27894	5.3	1%	Mar 14	SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the… Affected: 420; 430
CVE-2019-0331	5.3	1%	Aug 14	Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory… Affected: 4.1; 4.2; 4.3
CVE-2022-32244	5.2	0%	Sep 13	Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify system data but can't… Affected: 420; 430
CVE-2023-31404	5.0	0%	May 9	Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would… Affected: 420; 430
CVE-2022-35296	4.9	1%	Oct 11	Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network… Affected: 420; 430
CVE-2023-39440	4.4	0%	Aug 8	In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly,… Affected: 420
CVE-2018-2483	4.3	1%	Nov 13	HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC) by changing request method Affected: 4.1; 4.2