CVE-2025-42965 — Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promoti…

CVE-2025-42965

Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application PUBLISHED

Description (CNA)

SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP BusinessObjects BI Platform Central Management Console Promotion Management Application	affected ENTERPRISE 430; affected 2025; affected 2027

CWE

CWE-918

References

https://me.sap.com/notes/3598118
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.