Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server) (SAP_SE SAP BusinessObjects Business Intelligence Platform (Central Management Server))
En bref
- Source
- NVD
- EPSS
- EPSS 0.20 % · centile 9 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Awaiting Analysis
Rechercher sur…
Description
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.
Faiblesses (CWE)
- CWE-321 — Utilisation d'une clé cryptographique codée en dur
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.9 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N | sap |
| CVSS 3.1 | HIGH 7.9 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-55880
- GCVE · GCVE-0-2026-66763
Avis du CERT-FR
- CERTFR-2026-AVI-0998 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP BusinessObjects Business Intelligence Platform (Central Management Server) | affected ENTERPRISE 430 ; affected 2025 ; affected 2027 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |