CVE-2025-42907CWE-918ssrf

CVE-2025-42907

Medium · published September 23, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-23T06:15Z
References (2)
https://me.sap.com/notes/3540622 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 23 SEP 01:58Z
    Server-Side Request Forgery in SAP BI Platform
    cvelistv5