CVE-2024-28165 HIGH

CVE-2024-28165: Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

Vendor Sap_Se
Product SAP BusinessObjects Business Intelligence Platform
Weakness CWE-79 · XSS
Published May 14, 2024
Last update December 16, 2025
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application

Key dates

02Disclosure timeline

May 14, 2024 CVE published
December 16, 2025 Record updated