CVE-2025-23192

SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3560693	Permissions Required
https://url.sap/sapsecuritypatchday	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:businessobjects_business_intelligence:430::::enterprise:::
	cpe:2.3:a:sap:businessobjects_business_intelligence:2025::::-:::
	cpe:2.3:a:sap:businessobjects_business_intelligence:2027::::-:::

History

23 Oct 2025, 14:30

Type	Values Removed	Values Added
CPE		cpe:2.3:a:sap:businessobjects_business_intelligence:430::::enterprise::: cpe:2.3:a:sap:businessobjects_business_intelligence:2025::::-::: cpe:2.3:a:sap:businessobjects_business_intelligence:2027::::-:::
First Time		Sap businessobjects Business Intelligence Sap
References	~~() https://me.sap.com/notes/3560693 -~~	() https://me.sap.com/notes/3560693 - Permissions Required
References	~~() https://url.sap/sapsecuritypatchday -~~	() https://url.sap/sapsecuritypatchday - Patch

12 Jun 2025, 16:06

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-10 01:15

Updated : 2025-10-23 14:30

NVD link : CVE-2025-23192

Mitre link : CVE-2025-23192

CVE.ORG link : CVE-2025-23192

JSON object : View

Products Affected

sap

businessobjects_business_intelligence

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-23192", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.3, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}]}, "published": "2025-06-10T01:15:20.847", "references": [{"url": "https://me.sap.com/notes/3560693", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Patch"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability."}, {"lang": "es", "value": "SAP BusinessObjects Business Intelligence (BI Workspace) permite a un atacante no autenticado manipular y almacenar un script malicioso en un espacio de trabajo. Cuando la v\u00edctima accede al espacio de trabajo, el script se ejecuta en su navegador, lo que permite al atacante acceder a informaci\u00f3n confidencial de la sesi\u00f3n, modificarla o impedir su acceso. Esto afecta gravemente la confidencialidad y reduce la integridad y la disponibilidad."}], "lastModified": "2025-10-23T14:30:12.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "8FAA6380-851B-4A65-A052-CACE8B7E2340"}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence:2025:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "A8184AA4-D6C3-40D9-A6BA-B12C4039F02A"}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence:2027:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "09B714C1-C711-4F22-8692-4F5B34DCC609"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}