CVE-2025-25243

The CVE-2025-25243 vulnerability affects SAP Supplier Relationship Management (Master Data Management Catalog). An unauthenticated attacker can use a publicly available servlet to download arbitrary files over the network, exposing sensitive information. Impact is limited to confidentiality (high...

CVE-2025-25243 Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)

SAP Supplier Relationship Management Master Data Management Catalog allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or...

CVE-2025-25241 Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests)

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability...

CVE-2025-25241 Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests)

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability...

CVE-2025-25241

CVE-2025-25241 affects SAP Fiori Apps Reference Library (My Overtime Requests). The root cause is a missing authorization check, permitting a logged-in attacker to view or delete My Overtime Requests and potentially access employee information. The described impact is low for confidentiality and ...

CVE-2025-24876 Authentication bypass via authorization code injection in SAP Approuter

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application...

CVE-2025-24876

CVE-2025-24876 affects the SAP Approuter Node.js package, specifically version v16.7.1 and earlier. The vulnerability is an authentication bypass during the authorization code exchange, where an attacker can inject a malicious payload to steal the victim’s session. The practical impact is high co...

CVE-2025-24876 Authentication bypass via authorization code injection in SAP Approuter

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application...

CVE-2025-24875 SameSite Defense in Depth not applied for some cookies in SAP Commerce

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None SameSite=None. This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues...

CVE-2025-24875 SameSite Defense in Depth not applied for some cookies in SAP Commerce

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None SameSite=None. This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues...

CVE-2025-24875

CVE-2025-24875 corresponds to SAP Commerce where the Backoffice authentication cookies are by default configured with SameSite=None. Root cause: cookies set to None, weakening CSRF protections. Impact: CSRF risk with potential confidentiality/integrity concerns; exploitation status not detailed i...

CVE-2025-24874 Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice

SAP Commerce Backoffice uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence,...

CVE-2025-24874 Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice

SAP Commerce Backoffice uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence,...

CVE-2025-24874

CVE-2025-24874 affects SAP Commerce Backoffice. The issue is the use of the deprecated X-FRAME-OPTIONS header to prevent clickjacking; while currently effective, future browser support changes (favoring frame-ancestors CSP) could enable clickjacking, potentially exposing/modifying sensitive infor...

CVE-2025-24872 Missing Authorization check in SAP ABAP Platform (ABAP Build Framework)

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact...

CVE-2025-24872

CVE-2025-24872 concerns the SAP ABAP Platform, specifically the ABAP Build Framework. The authenticated attacker can gain unauthorized access to a specific transaction by invoking the add-on build functionality, allowing viewing of the transaction details. The documented impact is limited to conf...

CVE-2025-24872 Missing Authorization check in SAP ABAP Platform (ABAP Build Framework)

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact...

CVE-2025-24870 Insecure Key & Secret Management vulnerability in SAP GUI for Windows

SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive...

CVE-2025-24870 Insecure Key & Secret Management vulnerability in SAP GUI for Windows

SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive...

CVE-2025-24870

CVE-2025-24870 affects SAP GUI for Windows (and RFC service) where credentials are stored in the process memory. This can allow an unauthenticated (local) attacker to access sensitive information and cause privilege escalation, with confidentiality impact but no reported integrity/availability im...