Business Objects

Vendor:

First CVE: Mar 20, 2008 · Active for 18 years

25

Total CVEs

More Total CVEs than 49% of tracked products

2.8

Avg CVEs / Year

Bottom 1%

6.7

Avg CVSS

Higher Avg CVSS than 36% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Business Objects over time

Volume of CVEsAvg CVSS Base Score

First CVE

Mar 20, 2008

18 years ago

Most Recent CVE

Sep 12, 2023

1,049 days ago

CVE Severity & Scoring

Business Objects25 CVEs

48%

44%

All CVEs352,785 CVEs

45%

40%

11%

LowMediumHighCritical

Attack Vector

Local1 (4.0%)

Network9 (36.0%)

Unknown15 (60.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low9 (36.0%)

High1 (4.0%)

Unknown15 (60.0%)

User Interaction

None6 (24.0%)

Unknown15 (60.0%)

Required4 (16.0%)

Privileges Required

Low3 (12.0%)

High0 (0.0%)

None7 (28.0%)

Unknown15 (60.0%)

Top CVEs

Signals from CVEs in this product scope (25 CVEs).

25 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2010-0219HIGH Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, whi	Oct 18, 2010	10.0	92	NO	YES
CVE-2010-2103MEDIUM Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, a	May 27, 2010	4.3	42	NO	YES
CVE-2019-0259CRITICAL SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.	Feb 15, 2019	9.8	29	NO	NO
CVE-2015-7730HIGH SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and list	Oct 15, 2015	10.0	27	NO	NO
CVE-2014-9387HIGH SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORBA call, aka SAP Note 2039905.	Dec 17, 2014	10.0	26	NO	NO
CVE-2010-3983HIGH CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the Program Login property.	Oct 18, 2010	9.0	26	NO	NO
CVE-2007-6254HIGH Stack-based buffer overflow in the SAP Business Objects BusinessObjects RptViewerAX ActiveX control in RptViewerAX.dll in Business Objects 6.5 before CHF74 allows remote attackers	Mar 20, 2008	9.3	25	NO	NO
CVE-2022-28214HIGH During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Inf	May 11, 2022	7.8	24	NO	NO
CVE-2019-0289HIGH Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwis	May 14, 2019	7.1	24	NO	NO
CVE-2018-2408HIGH Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other acti	Apr 10, 2018	7.3	24	NO	NO

View all 25 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (25 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

1 CVE

4.0% of CVEs· Bottom 1%

Nuclei

1 CVE

4.0% of CVEs· Bottom 1%

ExploitDB

2 CVEs

8.0% of CVEs· 91st percentile

Social Chatter

Signals from CVEs in this product scope (25 CVEs).

Media Mentions

Signals from CVEs in this product scope (25 CVEs).

Top CNAs Publishing CVEs For Business Objects

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
4.30	2	6.6	1.1%	0
430	2	7.5	0.3%	0
4.3	5	7.3	1.3%	0
4.20	3	6.6	1.2%	0
420	2	7.5	0.3%	0
4.2	5	7.3	1.3%	0
4.10	2	6.9	1.5%	0
4.1	2	10.0	4.1%	0
4.0	5	5.4	2.0%	0
3.2	6	6.2	16.0%	1