Vulnerability · Published Jun 10, 2025 · Assigned by sap

CVE-2025-23192Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)

High 8.2

In plain English

A high-severity cross-site scripting in SAP BusinessObjects Business Intelligence (BI Workspace) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP BusinessObjects Business Intelligence (BI Workspace)	ENTERPRISE 43020252027

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

In plain English

Official description

Affected products (as reported)

References