Cross-Site Scripting Vulnerability in SAP BusinessObjects Platform

CVE-2025-24867

Summary

The SAP BusinessObjects Platform, specifically the BI Launchpad, suffers from a significant security flaw due to inadequate handling of user input. This flaw enables an unauthenticated attacker to create a crafted link that includes a malicious script within an unprotected parameter. When a victim interacts with this link, the embedded script executes in the browser context, potentially allowing the attacker to manipulate or access sensitive information related to the user's session without impacting the overall system availability. It's essential for users to ensure their systems are protected against this vulnerability to safeguard against exploitation.

References