Multiple Privilege Escalation Vulnerabilities in SAPCAR (SAP_SE SAPCAR)
En bref
- Source
- NVD
- EPSS
- EPSS 0.14 % · centile 3 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Deferred
Description
SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files and directory permissions without breaking signature validation, resulting in potential privilege escalation. This has high impact on integrity, but low impact on confidentiality and availability of the system.
Faiblesses (CWE)
- CWE-266 — Incorrect Privilege Assignment
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.9 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L | sap |
| CVSS 3.1 | MEDIUM 6.9 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-20329
- GCVE · GCVE-0-2025-42992
Avis du CERT-FR
- CERTFR-2025-AVI-0564 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAPCAR | affected SAP_CAR 7.53 ; affected 7.22EXT |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |