CVE-2025-23185 - CVE House

Back to Database

Status published Medium CVE-2025-23185

Information Disclosure in SAP Business Objects Business Intelligence Platform

4.1 CVSS

Vulnerability Description

Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privileges has access to this disclosed information, and they could use it to craft further exploits. There is no impact on the integrity and availability of the application.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-23185

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAP_SE

View All →

Missing Authorization Check in SAP Landscape Transformation (PCL Basis)

Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

Missing Authorization check in SAP Service Parts Management (SPM)

Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal

Missing Authorization check in SAP Service Parts Management (SPM)

Affected Vendor

SAP_SE

View all reports →

Affected Software

SAP Business Objects Business Intelligence Platform

Vulnerable Versions:

ENTERPRISE 430, 2025, 2027

Timeline

Official Publish: March 11th, 2025

Last Modified: March 11th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1592 Gather Victim Host Information

T1083 File and Directory Discovery

T1552 Unsecured Credentials

Credential Access

T1212 Exploitation for Defense Evasion

Defense Evasion

T1005 Data from Local System