CVE-2025-42988CWE-918

Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform

Low · published June 10, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
15.9
In the wild
Unconfirmed
What it is

Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and availability of the application.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-06-10T00:12Z
EPSS history
Timeline
  • 10 JUN 00:12Z
    Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform
    cvelistv5