Advisory
A note with CVSS 8.7 for component BI-BIP-INV was released by SAP on 14.01.2025. The correction/advisory 3474398 was described with "[CVE-2025-0061] Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform" and affects the system type BI/BO platform.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process.
The vulnerability addressed is code injection information disclosure within BI/BO platform.
Risk specification
This security note has been re-released with updated information in the Validity and Support Packages & Patches sections. It addresses a vulnerability that could allow an attacker to hijack user sessions or inject malicious code. Exploiting this flaw may enable unauthorized manipulation of application data or impersonation of privileged users, potentially leading to critical actions being performed within the platform without proper authorization.Solution
Sensitive information has been eliminated from client-side code to prevent unauthorized access or exploitation by potential attackers.
Affected System
SAP BusinessObjects Business Intelligence suite is an analytics platform allowing SAP customers to make better decisions based on their business data. SAP BI is a module meant for producing business insights and expands its power in combination with HANA DB and also exists as BW/4 HANA. Due to processing sensitive business data, the Data security is of utmost importance.
The advisory is valid for
