Paper/Archive/CVE-2025-0061

CVE-2025-0061

SAP_SE SAP BusinessObjects Business Intelligence Platform — Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 42.4.424 × 208.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.

Affected

ProductAffectedFixed inSource

SAP BusinessObjects Business Intelligence PlatformENTERPRISE 420–CNA

SAP BusinessObjects Business Intelligence Platform430–CNA

SAP BusinessObjects Business Intelligence Platform2025–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

sap (CNA)8.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3474398 refurl.sap/sapsecuritypatchday