CVE-2023-28764 Information Disclosure vulnerability in SAP BusinessObjects Platform
An unauthenticated attacker can intercept cleartext network traffic to steal sensitive user credentials and domain names from SAP BusinessObjects Platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28764?
CVE-2023-28764 is a low-severity vulnerability in SAP_SE SAP BusinessObjects Platform, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This could allow an unauthenticated attacker with deep knowledge to gain sensitive information such as user credentials and domain names, which may have a low impact on confidentiality and no impact on the integrity and availability of the system.
Weakness: CWE-522
Which versions are affected by CVE-2023-28764?
It affects 1 product.
Products include Sap Businessobjects.
How do I fix CVE-2023-28764?
No fix has been published for CVE-2023-28764 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-28764 being exploited?
There is no known exploitation of CVE-2023-28764 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP BusinessObjects Platform
- CVE-2015-7730 Denial of service in n/a
- CVE-2014-9387 Auth bypass in n/a
- CVE-2019-0259 File upload in SAP BusinessObjects Business Intelligence Platform Servers (Enterprise)
- CVE-2010-3983 Privilege escalation in n/a
- CVE-2022-28214 Information disclosure in SAP BusinessObjects Enterprise (Central Management Server)
Sources
Also known as GHSA-33w9-vc3g-2mjp.