← Vulnerability feed

Vulnerability record · CVE-2022-28214 · published 11 May 2022

CVE-2022-28214: Sap businessobjects cleartext storage of sensitive data vulnerability

Sap · Businessobjects

During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.

7.8 CVSS 3.1 High EPSS 0.17% · top 94.2% CWE-312 · Cleartext storage of sensitive data
7.8CVSS 3.1 base score, v2 4.6
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://launchpad.support.sap.com/#/notes/2998510 Permissions RequiredVendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
https://launchpad.support.sap.com/#/notes/2998510 Permissions RequiredVendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory

Track CVE-2022-28214 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2015-7730Sap businessobjects memory buffer overflow vulnerabilitySAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of servi…EPSS 3.6%10.0CVE-2014-9387Sap businessobjects permissions and access controls vulnerabilitySAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORB…EPSS 4.6%10.0CVE-2010-0219Apache Axis2 default admin password enables remote code executionApache Axis2, as bundled in products such as SAP BusinessObjects Enterprise XI 3.2 and CA ARCserve D2D r15, ships with a default password of 'axis2' …EPSS 91%analysed9.9CVE-2023-40622Sap businessobjects business intelligence incorrect permission assignment vulnerabilitySAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attack…EPSS 0.65%9.8CVE-2023-28765Sap businessobjects business intelligence information exposure vulnerabilityAn attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to…EPSS 15%9.8CVE-2019-0259Sap businessobjects unrestricted file upload vulnerabilitySAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file for…EPSS 2.0%9.6CVE-2018-2445Sap businessobjects business intelligence server-side request forgery (ssrf) vulnerabilityAdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send craft…EPSS 1.1%9.0CVE-2023-37490Sap businessobjects business intelligence uncontrolled search path element vulnerabilitySAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a …EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2022-28214), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.