CVE-2023-28764 - CVE House
Back to Database
Status published Low CVE-2023-28764

Information Disclosure vulnerability in SAP BusinessObjects Platform

Vulnerability Description

SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This could allow an unauthenticated attacker with deep knowledge to gain sensitive information such as user credentials and domain names, which may have a low impact on confidentiality and no impact on the integrity and availability of the system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28764

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAP_SE

View All →
CVE-2025-43011
Missing Authorization Check in SAP Landscape Transformation (PCL Basis)
High 7.7
CVE-2025-43010
Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))
High 8.3
CVE-2025-43009
Missing Authorization check in SAP Service Parts Management (SPM)
Medium 6.3
CVE-2025-43008
Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
Medium 5.8
CVE-2025-43007
Missing Authorization check in SAP Service Parts Management (SPM)
Medium 6.3

Affected Vendor

Affected Software

SAP BusinessObjects Platform
Vulnerable Versions:
420, 430

Timeline

Official Publish: May 9th, 2023
Last Modified: January 28th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-522

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1555 Credentials from Password Stores
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation