CVE-2025-42907

Server-Side Request Forgery in SAP BI Platform

State: Published
Severity: 4.3 Medium
Published: Sep 23, 2025
Updated: Oct 14, 2025
Reserved: Apr 16, 2025

Description

SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	sap

Weaknesses

CWE-918 Server-Side Request Forgery

Affected Products

Product	Versions
SAP BI PlatformSAP_SE	ENTERPRISE 430Affected 2025Affected 2027Affected

References

https://me.sap.com/notes/3540622
https://url.sap/sapsecuritypatchday

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.