CVE-2022-35169 Information disclosure in SAP BusinessObjects Business Intelligence Platform (LCM)

Medium 6.0 Published 12 Jul 2022 Updated 3 Aug 2024

An admin can read and decrypt LCMBIAR file passwords, allowing modification or import into other systems, impacting confidentiality.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-35169?

CVE-2022-35169 is a medium-severity vulnerability in Sap Businessobjects Business Intelligence Platform, published on 12 Jul 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain conditions, enabling the attacker to modify the password or import the file into another system causing high impact on confidentiality but a limited impact on the availability and integrity of the application.

Weakness: CWE-200

Which versions are affected by CVE-2022-35169?

It affects 1 product.

Products include Sap Businessobjects Business Intelligence Platform.

How do I fix CVE-2022-35169?

No fix has been published for CVE-2022-35169 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-35169 being exploited?

There is no known exploitation of CVE-2022-35169 in the wild and no public exploit code.

All Sap Businessobjects Business Intelligence Platform vulnerabilities

Sources

Also known as GHSA-hfqp-3m4c-35gc.