CVE-2023-28765

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420, 430

Description An attacker with basic privileges can access the lcmbiar file and decrypt it, potentially gaining access to BI user passwords. Depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.

Recommendations For versions 420 and 430, consider restricting access to the lcmbiar file as a temporary workaround until a patch is available. Additionally, review and limit the privileges of BI users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.