Cyber Posture

CVE-2025-0061

High

Published: 14 January 2025

Published
14 January 2025
Modified
24 October 2025
KEV Added
Patch
CVSS Score 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.0015 35.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0061 is a high-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability in Sap Businessobjects Business Intelligence Platform. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the specific information disclosure flaw in SAP BusinessObjects that enables unauthenticated session hijacking by applying vendor patches.

prevent

Ensures the authenticity of communications sessions, directly countering session hijacking by unauthenticated attackers exploiting disclosed session information.

prevent

Requires re-authentication for privileged or sensitive actions within sessions, limiting the scope of damage from hijacked sessions granting full data access and modification.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
Why these techniques?

Direct info disclosure of session data in public-facing SAP app enables session cookie theft (T1539) and subsequent use of alternate auth material (T1550.004) after initial exploitation (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.

Deeper analysisAI

CVE-2025-0061 is an information disclosure vulnerability (CWE-497) affecting the SAP BusinessObjects Business Intelligence Platform. Published on 2025-01-14, it carries a CVSS v3.1 base score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). The issue enables unauthenticated attackers to perform session hijacking over the network without any user interaction by disclosing sensitive session information.

An unauthenticated attacker with network access can exploit this vulnerability, which requires high attack complexity. Upon successful session hijacking, the attacker gains the ability to access and modify all data within the application, compromising confidentiality and integrity across a changed scope.

SAP provides mitigation details in security note 3474398 at https://me.sap.com/notes/3474398 and on the SAP Security Patch Day page at https://url.sap/sapsecuritypatchday. Security practitioners should consult these resources for patch availability and recommended remediation steps.

Details

CWE(s)

Affected Products

sap
businessobjects business intelligence platform
2025, 420, 430

CVEs Like This One

CVE-2026-0508Same product: Sap Businessobjects Business Intelligence Platform
CVE-2026-0490Same product: Sap Businessobjects Business Intelligence Platform
CVE-2026-0485Same product: Sap Businessobjects Business Intelligence Platform
CVE-2025-0064Same product: Sap Businessobjects Business Intelligence Platform
CVE-2026-24322Same vendor: Sap
CVE-2025-0066Same vendor: Sap
CVE-2026-23687Same vendor: Sap
CVE-2026-0488Same vendor: Sap
CVE-2026-0509Same vendor: Sap
CVE-2026-0506Same vendor: Sap

References