CVE-2025-42993mediumCWE-862

CVE-2025-42993: falha de média gravidade em SAP_SE SAP S/4HANA (Enterprise Event Enablement)

Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SAP S/4HANA

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.7epss 0.5%
Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC destination, leading to code execution under the privileges of the assigned high-privilege user. While the vulnerability has a low impact on Availability, it significantly poses a high risk to both Confidentiality and Integrity.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
SAP_SE · SAP S/4HANA (Enterprise Event Enablement)