Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace) (SAP_SE SAP BusinessObjects Business Intelligence (BI Workspace))
En bref
- Source
- NVD
- EPSS
- EPSS 0.37 % · centile 31 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Analyzed
Rechercher sur…
Description
SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L | sap |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-17607
- GCVE · GCVE-0-2025-23192
Avis du CERT-FR
- CERTFR-2025-AVI-0487 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:businessobjects_business_intelligence:430:*:*:*:enterprise:*:*:*cpe:2.3:a:sap:businessobjects_business_intelligence:2025:*:*:*:-:*:*:*cpe:2.3:a:sap:businessobjects_business_intelligence:2027:*:*:*:-:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP BusinessObjects Business Intelligence (BI Workspace) | affected ENTERPRISE 430 ; affected 2025 ; affected 2027 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |