CVE-2025-0062: medium-severity vulnerability in SAP_SE SAP BusinessObjects Business…
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.7epss 0.3%
SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availability. This vulnerability occurs only when script/html execution is enabled by the administrator in Central Management Console.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
SAP_SE · SAP BusinessObjects Business Intelligence PlatformRelated CVEs — SAP_SE SAP BusinessObjects Business…
In the same product, most dangerous first.
CVE-2024-41730CRITICALMissing Authentication check in SAP BusinessObjects Business Intelligence PlatformEPSS 75.9%CVE-2023-36917MEDIUMPassword Change rate limit bypass in SAP BusinessObjects Business Intelligence PlatformEPSS 0.6%CVE-2024-28165HIGHCross site scripting vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.6%CVE-2023-0020HIGHCVE-2023-0020EPSS 0.5%CVE-2025-0061HIGHMultiple vulnerabilities in SAP BusinessObjects Business Intelligence PlatformEPSS 0.5%CVE-2023-30740MEDIUMInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.5%