SAP Businessobjects Web Intelligence vulnerabilities

5 CVEs affecting SAP Businessobjects Web Intelligence, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-25646, published 2024-04-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-33667, published 2021-07-14. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a…
CVE-2023-42476, published 2023-12-12. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each…
CVE-2022-22546, published 2022-02-09. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Business Objects Web Intelligence (BI Launchpad) - version 420.
CVE-2024-25646, published 2024-04-09. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful…
CVE-2023-42474, published 2023-10-10. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an…