Riskcovery

CVE-2025-42965

Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application

State
Published
Severity
4.1 Medium
Published
Jul 8, 2025
Updated
Jul 11, 2025
Reserved
Apr 16, 2025

Read the record on cve.org

Description

SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.

Scores

CVSSScoreVectorSource
3.14.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:Nsap

Weaknesses

  • CWE-918 Server-Side Request Forgery

Affected Products

ProductVersions
SAP BusinessObjects BI Platform Central Management Console Promotion Management ApplicationSAP_SE
  • ENTERPRISE 430Affected
  • 2025Affected
  • 2027Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.