6.4
CVE-2025-43003
- EPSS 0.08%
- Published 13.05.2025 00:18:25
- Last modified 13.05.2025 19:35:18
- Source cna@sap.com
- Teams watchlist Login
- Open Login
SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on confidentiality and minimal impact on integrity and availability of the application.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorSAP_SE
≫
Product
SAP S/4HANA (Private Cloud & On-Premise)
Default Statusunaffected
Version
S4CRM 204
Status
affected
Version
205
Status
affected
Version
206
Status
affected
Version
S4CEXT 107
Status
affected
Version
108
Status
affected
Version
BBPCRM 702
Status
affected
Version
712
Status
affected
Version
713
Status
affected
Version
714
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.08% | 0.244 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| cna@sap.com | 6.4 | 1.6 | 4.7 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
|
CWE-749 Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.