CVE-2025-0061 is a high severity (CVSS 8.7) information disclosure in SAP BusinessObjects Business Intelligence Platform that can lead to session hijacking by an unauthenticated attacker over the network. SAP fixed it through SAP Note 3474398, so read the note and apply the patch for your release.
What's affected
The record names SAP BusinessObjects Business Intelligence Platform. The description says an unauthenticated attacker can perform session hijacking over the network without any user interaction, because of an information disclosure vulnerability, and that the attacker can access and modify all of the application's data.
The reference is SAP Note 3474398 and the SAP Security Patch Day page. SAP notes require a customer login, so we could not read the note, and the affected version ranges and the fixed support packages are not repeated here. Open the note in the SAP Support Portal for the product versions and patch levels.
The CVSS vector uses high attack complexity, which means that exploiting the issue depends on conditions outside the attacker's control. The scope is changed, so the impact reaches beyond the vulnerable component.
How to check if you're exposed
This is a vendor patch task, so the check happens in the SAP Support Portal.
- In the BusinessObjects Central Management Console, open the About or version information and note the version and support package or patch level.
- Sign in to the SAP Support Portal and open SAP Note 3474398.
- Compare your version with the affected versions and the corrections listed in the note.
- Check whether the BI platform is reachable from the internet, for example through a web server or reverse proxy that publishes the launchpad or Central Management Console.
If you cannot tell who in your organization owns the platform, ask the SAP basis or BI team.
What to do now
- Identify all BusinessObjects BI platform installations and their patch levels.
- Read SAP Note 3474398 and install the listed correction.
- Check whether the platform is exposed to the internet and restrict it if possible.
- Review session and authentication logs for unusual activity.
- Rotate service and administrator credentials after patching if you saw suspicious activity.
- Subscribe to SAP Security Patch Day notices for your environment.
Why it matters
Session hijacking means an attacker takes over a user's authenticated session, and then acts with that user's rights without needing the password. The weakness class here is exposure of sensitive system information to an unauthorized control sphere. If session identifiers or related data leak, they can be reused.
The record says the attacker can access and modify all data in the application, which for a reporting platform means business data, queries and connections to other systems. BI platforms often hold database credentials for many sources, which raises the stakes. Patch promptly and keep them off public networks.
The weakness class is CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. The CVSS vector in the record is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, which scores 8.7. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Why can't I see the fix details here?
The SAP note needs a customer login. Open it in the SAP Support Portal.
Does the attacker need to trick a user?
The record says no user interaction is needed.
Sources
Last reviewed: 19 October 2026.
