CVE-2025-0061
Published: 14 January 2025
Summary
CVE-2025-0061 is a high-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability in Sap Businessobjects Business Intelligence Platform. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0061 is an information disclosure vulnerability (CWE-497) affecting the SAP BusinessObjects Business Intelligence Platform. Published on 2025-01-14, it carries a CVSS v3.1 base score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). The issue enables unauthenticated attackers to perform session hijacking over the network without any user interaction by disclosing sensitive session information.
An unauthenticated attacker with network access can exploit this vulnerability, which requires high attack complexity. Upon successful session hijacking, the attacker gains the ability to access and modify all data within the application, compromising confidentiality and integrity across a changed scope.
SAP provides mitigation details in security note 3474398 at https://me.sap.com/notes/3474398 and on the SAP Security Patch Day page at https://url.sap/sapsecuritypatchday. Security practitioners should consult these resources for patch availability and recommended remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1491
Vulnerability details
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct info disclosure of session data in public-facing SAP app enables session cookie theft (T1539) and subsequent use of alternate auth material (T1550.004) after initial exploitation (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific information disclosure flaw in SAP BusinessObjects that enables unauthenticated session hijacking by applying vendor patches.
Ensures the authenticity of communications sessions, directly countering session hijacking by unauthenticated attackers exploiting disclosed session information.
Requires re-authentication for privileged or sensitive actions within sessions, limiting the scope of damage from hijacked sessions granting full data access and modification.