CVE-2025-0064 Overview
CVE-2025-0064 affects the Central Management Console (CMC) of the SAP BusinessObjects Business Intelligence platform. Under specific conditions, an attacker with administrative rights can generate or retrieve a secret passphrase used by the platform. That passphrase enables the attacker to impersonate any user in the system, including higher-privileged accounts. The flaw is tracked under [CWE-732: Incorrect Permission Assignment for Critical Resource]. It affects SAP BusinessObjects BI platform releases 430 and 2025. Exploitation is network-based and requires no user interaction, but it does require existing high-privilege access.
Critical Impact
An authenticated administrator can retrieve a secret passphrase from the Central Management Console and impersonate any user, resulting in high impact to confidentiality and integrity of BusinessObjects content and reporting data.
Affected Products
- SAP BusinessObjects Business Intelligence Platform, release 430 (Enterprise)
- SAP BusinessObjects Business Intelligence Platform, release 2025
- Central Management Console (CMC) component of the above releases
Discovery Timeline
- 2025-02-11 - CVE-2025-0064 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0064
Vulnerability Analysis
The vulnerability resides in the Central Management Console, the administrative web interface used to manage users, servers, and content in SAP BusinessObjects. Under specific conditions, the CMC exposes functionality that generates or returns a secret passphrase. This passphrase is intended to remain confidential and is used internally to establish trust for user sessions. Once retrieved, an attacker can craft authentication material that the platform accepts as any target user. The impersonation covers standard users and privileged accounts alike, giving the attacker access to reports, universes, and data connections tied to those identities.
Root Cause
The root cause is an incorrect permission assignment on a critical resource. The passphrase generation or retrieval endpoint is reachable by administrative users when it should be restricted or, at minimum, protected against reuse for impersonation. [CWE-732] describes exactly this class of flaw, where a sensitive resource is exposed to actors that should not be able to read or regenerate it.
Attack Vector
An attacker must first hold administrator rights on the CMC. From there, the attack proceeds over the network against the CMC web interface. The attacker triggers the passphrase generation or retrieval workflow, captures the returned secret, and uses it to construct impersonated sessions or tokens for any user in the deployment. No user interaction is required, and no local access to the BusinessObjects host is needed.
No verified public proof-of-concept code is available for CVE-2025-0064. Refer to SAP Note #3525794 for vendor technical details.
Detection Methods for CVE-2025-0064
Indicators of Compromise
- Administrative sessions in the CMC that access passphrase generation, key management, or trusted authentication configuration endpoints outside of routine change windows.
- Successful logons for user accounts from source addresses, clients, or user agents that do not match those users' historical patterns.
- Report and universe access by accounts that have been dormant, followed by data exports or scheduled job creation.
Detection Strategies
- Enable CMC auditing and forward audit events to a SIEM to correlate administrator actions with subsequent authentication activity for other users.
- Alert on any use of trusted authentication or passphrase-related administrative APIs, and require change tickets to justify each occurrence.
- Baseline the set of administrators permitted to touch cryptographic material in the CMC and flag deviations.
Monitoring Recommendations
- Monitor for lateral impersonation patterns where an administrator logon is quickly followed by successful logons as multiple distinct users from the same source.
- Track exports of reports containing regulated data and tie those events back to the initiating identity and session origin.
- Review scheduled jobs and content ownership changes on a recurring cadence to catch persistence introduced through impersonated accounts.
How to Mitigate CVE-2025-0064
Immediate Actions Required
- Apply the SAP security patch referenced in SAP Note #3525794 to all affected BusinessObjects BI platform 430 and 2025 systems.
- Review the list of accounts with CMC administrative rights and remove any that are not strictly required.
- Rotate any secrets, service account credentials, and trusted authentication material associated with the BusinessObjects deployment after patching.
Patch Information
SAP addressed CVE-2025-0064 as part of SAP Security Patch Day. Customers should consult the SAP Security Patch Day portal for the current patch release covering their support package level, and apply the corrections described in SAP Note #3525794.
Workarounds
- Restrict network reachability of the CMC to a management VLAN or jump-host segment so only vetted administrators can access it.
- Enforce multi-factor authentication for all BusinessObjects administrator accounts to raise the cost of gaining the prerequisite admin rights.
- Increase CMC audit verbosity and review administrative activity daily until patches are deployed across all instances.
# Configuration example: restrict CMC access at the network layer
# Replace with your firewall syntax; illustrative iptables rules shown
iptables -A INPUT -p tcp --dport 6405 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6405 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
