Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

SAP BusinessObjects: Admins Can Steal User Credentials

CVE-2025-0064 · published 1 year ago
Summary

If an attacker with admin rights on the SAP BusinessObjects platform can exploit this issue, they can steal other users' login credentials and pretend to be them. This could lead to unauthorized access and sensitive information theft. To protect your system, ensure that admin rights are only granted to trusted users and consider implementing additional security measures.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sap businessobjects_business_intelligence_platform 430
2025
cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:enterprise:*:*:*
Original advisory text
Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase,...
Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published11 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-0064 · NVD
Track software like this
Free during beta