How severe is CVE-2025-31332?

CVE-2025-31332 has a CVSS 3.x base score of 6.6, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability high.

Is CVE-2025-31332 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-31332?

CVE-2025-31332 affects Sap Businessobjects Business Intelligence Platform. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-31332?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-31332 have an EU (EUVD) identifier?

Yes. CVE-2025-31332 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-10093.

When was CVE-2025-31332 published?

CVE-2025-31332 was published on 2025-04-08 and last updated on 2026-06-17.

CVE-2025-31332

CVE-2025-31332 is a medium-severity vulnerability in Sap Businessobjects Business Intelligence Platform with a CVSS 3.x base score of 6.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-277.

Key facts

Severity: Medium (CVSS 3.x base score 6.6)
EPSS exploit prediction: 0% (3rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-10093
Weakness: CWE-277
Affected product: Sap Businessobjects Business Intelligence Platform
Published: 2025-04-08
Last modified: 2026-06-17

Description

Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity and availability. However, this vulnerability does not disclose any sensitive data.

Frequently asked questions

What is CVE-2025-31332?: Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity and availability. However, this vulnerability does not disclose any sensitive data.
How severe is CVE-2025-31332?: CVE-2025-31332 has a CVSS 3.x base score of 6.6, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability high.
Is CVE-2025-31332 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-31332?: CVE-2025-31332 affects Sap Businessobjects Business Intelligence Platform. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-31332?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-31332 have an EU (EUVD) identifier?: Yes. CVE-2025-31332 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-10093.
When was CVE-2025-31332 published?: CVE-2025-31332 was published on 2025-04-08 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:enterprise:*:*:*

More vulnerabilities in Sap Businessobjects Business Intelligence Platform

CVE-2023-0018 — Critical (CVSS 10.0): Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC…
CVE-2023-0022 — Critical (CVSS 9.9): SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject…
CVE-2020-6242 — Critical (CVSS 9.8): SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an…
CVE-2020-6195 — Critical (CVSS 9.8): SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response,…
CVE-2020-26831 — Critical (CVSS 9.6): SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML…
CVE-2020-6294 — Critical (CVSS 9.1): Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any…

All CVEs affecting Sap Businessobjects Business Intelligence Platform →

Other CWE-277 vulnerabilities

CVE-2024-36540 — Critical (CVSS 9.8): Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by…
CVE-2024-36539 — Critical (CVSS 9.8): Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining…
CVE-2026-7891 — Critical (CVSS 9.3): The VerySecureApp made by DIVD using Mendix Studio Pro 11.8.0 Beta allows unintended data exposure due to authorization…
CVE-2024-36542 — High (CVSS 8.8): Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the…
CVE-2024-6605 — High (CVSS 8.8): Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This…
CVE-2023-27842 — High (CVSS 8.8): Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to…

Browse all CWE-277 vulnerabilities →