Medium severity · published Mar 11, 2025
CVE-2025-23185
Information Disclosure in SAP Business Objects Business Intelligence Platform
4.1
CVSS
0.3%
EPSS
No
On KEV
Description
Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privileges has access to this disclosed information, and they could use it to craft further exploits. There is no impact on the integrity and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business Objects Business Intelligence Platform · SAP_SE
ENTERPRISE 430; 2025; 2027 · source: vendor
Affected product
SB
SAP Business Objects Business Intelligence Platform
SAP_SE
More from SAP Business Objects Business Intelligence Platform
5.3
CVE-2025-42988
Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform
4.3
CVE-2026-44755
Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform