CVE-2025-0064: Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)

Published Feb 11, 2025

Updated

Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability.

Affected Software

3 affected components

SAP BusinessObjects Business Intelligence platform

SAP BusinessObjects Business Intelligence platform=430

SAP BusinessObjects Business Intelligence platform=2025

Remediation

Patch Available

https://url.sap/sapsecuritypatchday

Event History

Feb 11, 2025

CVE Published

via MITRE·12:33 AM

Data Sourced

via MITRE·12:33 AM

DescriptionSeverity

Data Sourced

via NVD·01:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the impact of CVE-2025-0064?

CVE-2025-0064 allows an attacker with admin rights to impersonate any user by generating or retrieving a secret passphrase, posing a significant security risk.

Which software is affected by CVE-2025-0064?

CVE-2025-0064 specifically affects the SAP BusinessObjects Business Intelligence platform.

How do I fix CVE-2025-0064?

To fix CVE-2025-0064, update to the latest version of the SAP BusinessObjects Business Intelligence platform that addresses this vulnerability.

What are the exploit conditions for CVE-2025-0064?

CVE-2025-0064 can be exploited under specific conditions where an attacker already possesses admin rights within the Central Management Console.

Is there a patch available for CVE-2025-0064?

Yes, SAP has provided patches that address CVE-2025-0064, and it is recommended to apply them as soon as possible.