CVE-2025-0060CWE-94

Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform

Medium · published January 14, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
33.8
In the wild
Unconfirmed
What it is

SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-01-14T00:09Z
EPSS history
Timeline
  • 14 JAN 00:09Z
    Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform
    cvelistv5