- 143/2025
- Critical
SAP has released security updates to address several vulnerabilities affecting multiple SAP products.
SAP has released a patch that fixes several vulnerabilities affecting multiple SAP products such as SAP Supplier Relationship Management, SAP NetWeaver, SAP S/4HANA and SAP SCM, SAP GRC, SAP Business Warehouse, SAP Business Objects Business Intelligence Platform, SAP MDM Server, SAP Business Warehouse.
The attacker could exploit some of these vulnerabilities to perform denial of service attacks, gain elevated privileges, obtain sensitive information, bypass security restrictions, manipulate data, or gain access to the affected product.
Sample of the addressed vulnerabilities:
1. SAP S/4HANA and SAP SCM (Characteristic Propagation) Code Injection Vulnerability (CVE-2025-42967):
- CVSS: 9.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Consequences: Gain Access
2. SAP Business Warehouse and SAP Plug-In Basis Missing Authorization check Vulnerability (CVE-2025-42952):
- CVSS: 7.7
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Consequences: Data Manipulation
Vulnerabilities
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.