CVE-2025-42907: Server-Side Request Forgery in SAP BI Platform

Published Sep 23, 2025

Updated

SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.

Affected Software

1 affected component

SAP BI Platform

Event History

Sep 23, 2025

CVE Published

via MITRE·01:58 AM

Data Sourced

via MITRE·01:58 AM

DescriptionSeverity

Data Sourced

via NVD·02:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-42907?

CVE-2025-42907 is classified with a low impact on integrity.

How does CVE-2025-42907 affect SAP BI Platform?

CVE-2025-42907 allows an attacker to modify the LogonToken IP address, potentially redirecting requests to a different server.

Is there any impact on confidentiality and availability in CVE-2025-42907?

CVE-2025-42907 has no impact on the confidentiality and availability of the SAP BI Platform.

What are the consequences of exploiting CVE-2025-42907?

Exploitation of CVE-2025-42907 primarily compromises integrity, leading to potentially misleading interactions with the BI platform.

What mitigation strategies can be applied for CVE-2025-42907?

To mitigate CVE-2025-42907, applying patches and ensuring secure configurations in the SAP BI Platform is recommended.