PT-2025-49771 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-42896

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (affected versions not specified)

Description An unauthenticated remote attacker can send specially crafted requests through a URL parameter controlling the login page error message. This can cause the server to retrieve URLs supplied by the attacker, potentially impacting confidentiality and integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2025-15898

CVE-2025-42896

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 7

• https://bdu.fstec.ru/vul/2025-15898 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42896 · Security Note
• https://t.me/CVEtracker/39200 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1998225332772782244 · Twitter Post
• https://me.sap.com/notes/3651390 · Note