The vulnerability allows an unauthorized attacker to reach a specific endpoint within the SAP Business Objects application and obtain sensitive information. This results in a low level compromise of confidentiality, while integrity and availability remain unaffected. The weakness arises from a security misconfiguration (CWE‑497). The likely attack vector is inferred to be an unauthenticated or poorly authenticated HTTP request to the misconfigured endpoint, because the description states the attacker must access a particular endpoint that is not properly protected.

This issue affects the SAP Business Objects product from SAP. No specific versions are listed in the CNA data, so any deployment of SAP Business Objects that includes the affected endpoint could potentially be vulnerable.

The CVSS score of 3.7 classifies the risk as low, and the vulnerability is not listed in the CISA KEV catalog. Because EPSS data is not available, the likelihood of exploitation cannot be quantified, but the need to access a particular endpoint suggests that an attacker would first need to bypass normal authentication controls or exploit a misconfiguration that allows unauthenticated requests. Given the limited scope and low confidentiality impact, the overall risk to an organization is modest, although the presence of misconfigured endpoints should be remedied promptly.