SAP BusinessObjects Business Intelligence Platform Insecure File Operations Vulnerability (3565279)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote host is prior to 2025 SP000 000000, 4.3 SP004 001300, or 4.3 SP005 000000. It is, therefore, affected by a vulnerability as referenced in the 3565279 advisory. The file upload logic in Apache Struts is flawe...

CVE-2025-42985

Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality a...

CVE-2025-31326

SAP�BusinessObjects Business�Intelligence Platform Web Intelligence is vulnerable to HTML Injection, allowing an attacker with basic user privileges to inject malicious code into specific input fields. This could lead to unintended redirects or manipulation of application behavior, such as...

CVE-2025-42985

Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality a...

CVE-2025-31326

SAP�BusinessObjects Business�Intelligence Platform Web Intelligence is vulnerable to HTML Injection, allowing an attacker with basic user privileges to inject malicious code into specific input fields. This could lead to unintended redirects or manipulation of application behavior, such as...

CVE-2025-42985 Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench

Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality a...

CVE-2025-42985

CVE-2025-42985 affects SAP BusinessObjects Content Administrator Workbench, where insufficient input sanitization allows crafting malicious URLs that can execute scripts in a victim’s browser. The likely impact is low confidentiality and integrity impact with no availability impact, per the CVE d...

CVE-2025-42985 Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench

Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality a...

CVE-2025-42965 Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application

SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitati...

CVE-2025-42965 Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application

SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitati...

CVE-2025-31326 HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP�BusinessObjects Business�Intelligence Platform Web Intelligence is vulnerable to HTML Injection, allowing an attacker with basic user privileges to inject malicious code into specific input fields. This could lead to unintended redirects or manipulation of application behavior, such as...

CVE-2025-31326 HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP�BusinessObjects Business�Intelligence Platform Web Intelligence is vulnerable to HTML Injection, allowing an attacker with basic user privileges to inject malicious code into specific input fields. This could lead to unintended redirects or manipulation of application behavior, such as...

PT-2025-28274 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Web Intelligence affected versions not specified Description: The issue allows an attacker with basic user privileges to inject malicious code into specific input fields, potentially leading ...

PT-2025-28297 · Sap · Sap Businessobjects Content Administrator Workbench

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Content Administrator Workbench affected versions not specified Description: The issue is due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, allowing attackers to craft malicious...

The vulnerability of the Web Intelligence component of the SAP BusinessObjects Business Intelligence platform allows a perpetrator to upload arbitrary files.

The vulnerability of the Web Intelligence component of the SAP BusinessObjects Business Intelligence platform is related to the use of an unreliable search path. Exploiting this vulnerability allows attackers to upload arbitrary files...

SAP BusinessObjects Business Intelligence Cross-Site Scripting Vulnerability

SAP BusinessObjects Business Intelligence is an enterprise-class business intelligence solution from SAP. SAP BusinessObjects Business Intelligence suffers from a cross-site scripting vulnerability that originates from an unauthenticated attacker who can store malicious scripts, which can be...

CVE-2025-23192

SAP BusinessObjects Business Intelligence BI Workspace allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session...

CVE-2025-23192

CVE-2025-23192 - SAP BusinessObjects BI Workspace is described as an unauthenticated cross-site scripting (XSS) vulnerability where an attacker can craft and store malicious scripts in a BI workspace; when victims load the workspace, the script can access session data and affect confidentiality (...

CVE-2025-23192 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)

SAP BusinessObjects Business Intelligence BI Workspace allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session...

CVE-2025-23192 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)

SAP BusinessObjects Business Intelligence BI Workspace allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session...