CVE-2025-24867 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad)
An unauthenticated attacker can execute malicious scripts in a victim's browser via a crafted URL, allowing access to or modification of web client information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-24867?
CVE-2025-24867 is a medium-severity cross-site scripting vulnerability in SAP_SE SAP BusinessObjects Platform (BI Launchpad), published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application allows an unauthenticated attacker to craft a URL that embeds a malicious script within an unprotected parameter. When a victim clicks the link, the script will be executed in the browser, giving the attacker the ability to access and/or modify information related to the web client with no effect on availability.
Weakness: CWE-79
Which versions are affected by CVE-2025-24867?
How do I fix CVE-2025-24867?
No fix has been published for CVE-2025-24867 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-24867 being exploited?
There is no known exploitation of CVE-2025-24867 in the wild and no public exploit code.
Sources
Also known as GHSA-6p5r-jjpf-g5xv.