6.4
CVE-2025-43003
- EPSS 0.08%
- Veröffentlicht 13.05.2025 00:18:25
- Zuletzt bearbeitet 13.05.2025 19:35:18
- Quelle cna@sap.com
- Teams Watchlist Login
- Unerledigt Login
SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on confidentiality and minimal impact on integrity and availability of the application.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSAP_SE
≫
Produkt
SAP S/4HANA (Private Cloud & On-Premise)
Default Statusunaffected
Version
S4CRM 204
Status
affected
Version
205
Status
affected
Version
206
Status
affected
Version
S4CEXT 107
Status
affected
Version
108
Status
affected
Version
BBPCRM 702
Status
affected
Version
712
Status
affected
Version
713
Status
affected
Version
714
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.08% | 0.244 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@sap.com | 6.4 | 1.6 | 4.7 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
|
CWE-749 Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.