CVE-2023-23856: SAP Business Objects Business Intelligence Platform

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause a low impact on integrity of the application.

Affected products

• SAP Business Objects Business Intelligence Platform: version 430 only

Published 2023-02-14. Last modified 2026-06-17.