Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise) (SAP_SE SAP S/4HANA (Private Cloud or On-Premise))
At a glance
- Source
- NVD
- EPSS
- EPSS 0.28 % · percentile 20 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Deferred
Description
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality.
Weaknesses (CWE)
- CWE-1287 — Improper Validation of Specified Type of Input
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H | sap |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-27209
- GCVE · GCVE-0-2025-42916
CERT-FR advisories
- CERTFR-2025-AVI-0764 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP S/4HANA (Private Cloud or On-Premise) | affected S4CORE 102 ; affected 103 ; affected 104 ; affected 105 ; affected 106 ; affected 107 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |