This vulnerability (CWE-79) in SAP BusinessObjects Business Intelligence Platform versions ENTERPRISE 430, 2025, and 2027 allows an authenticated attacker to perform cross-site scripting by injecting malicious JavaScript payloads through crafted URLs. The injected script executes in the context of the victim's browser upon accessing the URL, potentially exposing restricted information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, required user interaction, and partial confidentiality impact without integrity or availability impact. No vendor patch or official remediation level has been published as of the data provided.

The vulnerability can lead to the exposure of restricted information due to script execution in the victim's browser, impacting confidentiality at a low level. There is no impact on data integrity or system availability. Exploitation requires the attacker to be authenticated and the victim to interact with a malicious URL. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should limit exposure by restricting access to the affected SAP BusinessObjects Business Intelligence Platform versions to trusted users only and educate users about the risks of clicking on untrusted URLs. Monitor SAP's official channels for updates on patches or mitigations.