CVE-2025-42907

Description

SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.

PUBLISHED Reserved 2025-04-16 | Published 2025-09-23 | Updated 2025-10-14 | Assigner sap

Problem types

CWE-918: Server-Side Request Forgery

Product status

References

me.sap.com/notes/3540622

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42907)

nvd.nist.gov (CVE-2025-42907)

Download JSON