CVE-2025-0064

CVE-2025-0064 is a vulnerability in the Central Management Console of the SAP BusinessObjects Business Intelligence platform. Under specific conditions, an attacker with administrative rights can generate or retrieve a secret passphrase, which enables them to impersonate any user in the system. This issue, linked to CWE-732 (Incorrect Permission Assignment for Critical Resource), carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting high impacts on confidentiality and integrity with no availability disruption.

Exploitation requires an attacker to possess administrative privileges on the affected system, allowing network-based access with low complexity and no user interaction. Successful exploitation grants the ability to impersonate any user, potentially leading to unauthorized access to sensitive data and manipulation of system configurations or reports.

SAP advisories, including security note 3525794 and details from the SAP Security Patch Day, provide guidance on mitigation, such as applying available patches to address the vulnerability in the Central Management Console.