What’s Vulnerable › Vulnerabilities
CVE-2025-42988: Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-10 · updated 2026-06-17
- Weakness: CWE-918
Description
Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and availability of the application.
Affected products
- SAP_SE SAP BusinessObjects Business Intelligence Platform: 430, 2025, 2027
References
Get alerted when CVE-2025-42988 or the next vulnerability affects your stack