CVE-2025-0064

Feb. 18, 2025, 6:15 p.m.

8.7
High

Description

Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability.

Product(s) Impacted

Product Versions
SAP BusinessObjects Business Intelligence platform
  • []

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-732
Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References

https://me.sap.com/notes/3525794
https://url.sap/sapsecuritypatchday

Tags

CWE-732
cna@sap.com
2025-02-11
CVE-2025-0064

CVSS Score

8.7 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

    View Vector String

Timeline

Published: Feb. 11, 2025, 1:15 a.m.
Last Modified: Feb. 18, 2025, 6:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@sap.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.