CVE-2025-23192

Description

SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability.

Reserved 2025-01-13 | Published 2025-06-10 | Updated 2025-06-10 | Assigner sap

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation

Product status

Default status
unaffected

ENTERPRISE 430
affected

2025
affected

2027
affected

References

me.sap.com/notes/3560693

url.sap/sapsecuritypatchday

cve.org (CVE-2025-23192)

nvd.nist.gov (CVE-2025-23192)

Download JSON