CVE-2024-25646

6.5 mediumEPSS 0.4%

Medium (6.5) in sap businessobjects web intelligence. EPSS 0.4% chance of exploitation in the next 30 days.

Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2024-04-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sap:businessobjects_web_intelligence

References

https://me.sap.com/notes/3421384
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
https://me.sap.com/notes/3421384
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Check your stack JSON