Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-41730: SAP BusinessObjects BI Platform allows unauthorized login via SSO
CVE-2024-41730 · published 2 years ago
Summary
When Single Sign‑On is turned on, anyone can request a login token through a web API and gain access to the BusinessObjects system. This could let an attacker view, change, or disrupt your data and reports. Disable SSO or apply the vendor’s update and restrict access to the API to trusted users.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap | business_objects_business_intelligence_platform |
enterprise_430 enterprise_440 cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_430:*:*:*:*:*:*:* |
| sap_se | sap businessobjects business intelligence platform | ENTERPRISE 430 |
Original advisory text
Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
In SAP BusinessObjects Business Intelligence
Platform, if Single Signed On is enabled on Enterprise authentication, an
unauthorized user can get a logon token using a REST endpoint. The attacker can
fully compromise the system resulting in High impact on confidentiality,
integrity and availability.
Platform, if Single Signed On is enabled on Enterprise authentication, an
unauthorized user can get a logon token using a REST endpoint. The attacker can
fully compromise the system resulting in High impact on confidentiality,
integrity and availability.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-862Missing Authorization
Timeline
Published13 Aug 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta