CVE-2025-31332
Sap Businessobjects Business Intelligence Platform 430
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:HSummary
CVE-2025-31332 is a medium-severity Insecure Inherited Permissions (CWE-277) vulnerability in Sap Businessobjects Business Intelligence Platform. Its CVSS base score is 6.6 (Medium).
Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10093
Vulnerability Data
Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity and availability.…
more
However, this vulnerability does not disclose any sensitive data.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces file-system access permissions so that only authorized subjects may modify SAP BusinessObjects files.
Requires that file permissions grant only the minimum privileges needed, eliminating the excessive write access that enables the attack.
Restricts the ability to change system files or configurations to authorized roles, limiting the impact of local accounts that obtain write access.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly addresses defining and enforcing secure access permissions and least privilege, which prevents insecure inheritance.
Configuration management practices include establishing secure permission baselines that avoid insecure inheritance.
Secure SDLC practices would catch and prevent defining insecure inherited permissions during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing may detect permission issues but does not prevent insecure inheritance by design.
Privileged access rights management can limit inheritance of excessive permissions but does not directly address insecure default permission inheritance.
Secure development lifecycle practices can include permission model reviews but do not guarantee secure inherited permissions.
Secure system architecture principles can incorporate least-privilege permission models but do not specifically mandate secure inheritance.
Secure coding standards can explicitly require setting restrictive permissions at object creation, directly mitigating insecure inheritance.
Information access restriction policies can reduce risk from inherited permissions but do not enforce secure permission inheritance at creation time.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Windows Server 2016 (1 rule)
- V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-277