Memory Corruption vulnerability in SAPCAR (SAP_SE SAPCAR)
En bref
- Source
- NVD
- EPSS
- EPSS 0.15 % · centile 5 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Deferred
Description
A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets processed by SAPCAR on their system, resulting in out-of-bounds memory read and write. This could lead to file extraction and file overwrite outside the intended directories. This vulnerability has low impact on the confidentiality, integrity and availability of the application.
Faiblesses (CWE)
- CWE-787 — Écriture hors limites
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L | sap |
| CVSS 3.1 | MEDIUM 4.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-20338
- GCVE · GCVE-0-2025-42971
Avis du CERT-FR
- CERTFR-2025-AVI-0564 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAPCAR | affected SAP_CAR 7.53 ; affected 7.22EXT |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |