CVE-2025-24867 — Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad)

CVE-2025-24867

Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad) PUBLISHED

Description (CNA)

SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application allows an unauthenticated attacker to craft a URL that embeds a malicious script within an unprotected parameter. When a victim clicks the link, the script will be executed in the browser, giving the attacker the ability to access and/or modify information related to the web client with no effect on availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP BusinessObjects Platform (BI Launchpad)	affected ENTERPRISE 430; affected 2025

CWE

CWE-79

References

https://me.sap.com/notes/3445708
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.