CVE-2025-23192 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)

High 8.2 Published 10 Jun 2025 Updated 10 Jun 2025

Unauthenticated attackers can inject malicious scripts into SAP BI Workspace, allowing them to steal session data or modify browser content when victims access the workspace.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-23192?

CVE-2025-23192 is a high-severity cross-site scripting vulnerability in SAP_SE SAP BusinessObjects Business Intelligence (BI Workspace), published on 10 Jun 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability.

Weakness: CWE-79

Which versions are affected by CVE-2025-23192?

It affects 1 product.

Products include Sap Businessobjects Business Intelligence.

How do I fix CVE-2025-23192?

No fix has been published for CVE-2025-23192 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-23192 being exploited?

There is no known exploitation of CVE-2025-23192 in the wild and no public exploit code.

Sources

Also known as GHSA-38cm-xhvr-78fr.