Vulnerability · Published Jan 14, 2025 · Assigned by sap
CVE-2025-0060Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform
Medium 6.5
In plain English
A medium-severity code injection in SAP BusinessObjects Business Intelligence Platform from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP BusinessObjects Business Intelligence Platform | ENTERPRISE 4204302025 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N