NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP-producten
view advisory published 2025-04-09
SAP heeft kwetsbaarheden verholpen in verschillende producten, waaronder SAP Financial Consolidation, SAP Landscape Transformation, SAP NetWeaver Application Server ABAP, SAP Commerce Cloud, SAP ERP BW, SAP BusinessObjects Business Intelligence Platform, SAP KMC WPC, SAP Solution Manager, SAP S4CORE, en SAP CRM.
01
describes (23)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-31324US | critical9.8OT critical | KEV | ||
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries tha… | ||||
| CVE-2025-31328US | — | — | ||
SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based… | ||||
| CVE-2025-31327US | — | — | ||
SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker c… | ||||
| CVE-2025-31333US | — | — | ||
SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on integrity of the appl… | ||||
| CVE-2025-31332US | high7.1 | — | ||
Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting ope… | ||||
| CVE-2025-31331US | —OT elevated | — | ||
SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the… | ||||
| CVE-2025-31330US | — | — | ||
SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arb… | ||||
| CVE-2025-30017US | —OT elevated | — | ||
Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitat… | ||||
| CVE-2025-30016US | — | — | ||
SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authentication mechanisms,… | ||||
| CVE-2025-30015US | — | — | ||
Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges could execute cert… | ||||
| CVE-2025-30014US | — | — | ||
SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from dire… | ||||
| CVE-2025-30013US | — | — | ||
SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handl… | ||||
| CVE-2025-27437US | —OT elevated | — | ||
A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-admi… | ||||
| CVE-2025-27435US | —OT elevated | — | ||
Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce… | ||||
| CVE-2025-27429US | — | — | ||
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into t… | ||||
| CVE-2025-27428US | —OT elevated | — | ||
Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon successful exploitation,… | ||||
| CVE-2025-26657US | —OT elevated | — | ||
SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentia… | ||||
| CVE-2025-26654US | —OT elevated | — | ||
SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce no… | ||||
| CVE-2025-26653US | — | — | ||
SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, wit… | ||||
| CVE-2025-23186US | — | — | ||
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be… | ||||
showing 20 of 23
02
references
External citations — patches, advisories, analysis.
- Reference - cisagov; cveprojectv5; nvdexternal
- Reference - ncscclearexternal
- Reference - ncscclearexternal
- Reference - certbunddeexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan