Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW) (SAP_SE SAP Business Objects Business Intelligence Platform (PMW))
At a glance
- Source
- NVD
- EPSS
- EPSS 0.16 % · percentile 5 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Deferred
Description
Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This has High impact on Confidentiality with Low impact on Integrity and Availability of the application.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | sap |
| CVSS 3.1 | HIGH 7.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-14348
- GCVE · GCVE-0-2025-43000
CERT-FR advisories
- CERTFR-2025-AVI-0396 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Business Objects Business Intelligence Platform (PMW) | affected ENTERPRISE 430 ; affected 2025 ; affected 2027 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |