A reflected cross‑site scripting flaw allows an authenticated user to embed malicious JavaScript within crafted URLs on the SAP BusinessObjects Business Intelligence Platform. When another user opens such a URL, the script runs in the victim's browser, potentially allowing the attacker to read or exfiltrate restricted information. Although the vulnerability carries a low CVSS score, it still permits the disclosure of confidential data without affecting integrity or availability.

Vulnerable products include the SAP BusinessObjects Business Intelligence Platform. No specific affected software versions are supplied in the advisory, so all deployments of the platform that have not applied the latest SAP security patch may be at risk.

The CVSS base score of 4.1 indicates low severity, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting a limited threat landscape. The likely attack path requires an authenticated attacker to craft a malicious URL and a separate victim user to click it; therefore the exploitability is constrained to social engineering or phishing scenarios. With the EPSS score unavailable, it is prudent to treat the risk as moderate until a real‑world exploit is documented.