Summary
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.
Product
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Vulnerabilities 23
-
Critical 10.0
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the conf…
KEV Apr 29, 2025 -
Critical 9.9
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effecti…
-
Critical 9.9
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. Thi…
-
Critical 9.8
Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CV…
-
Critical 9.8
Authentication Bypass Vulnerability in SAP Financial Consolidation
SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authentication mechanisms, due to which there is high impact on the Confidentiality, Integrity & Availabi…
-
High 8.7
Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)
Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This res…
-
High 8.5
Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be…
-
High 7.7
Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)
Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon successful exploitation, they could read files from any managed system connected to SAP Solution Manager…
-
High 7.7
Directory Traversal vulnerability in SAP Capital Yield Tax Management
SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confident…
-
Medium 6.8
Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)
SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integ…
-
Medium 6.7
Code Injection vulnerability in SAP ERP BW Business Content
SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerabi…
-
Medium 6.6
Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform
Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity a…
-
Medium 5.3
Information Disclosure vulnerability in SAP KMC WPC
SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability.
-
Medium 4.7
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. W…
-
Medium 4.6
Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)
SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This…
-
Medium 4.4
Missing Authorization check in SAP Solution Manager
Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of …
-
Medium 4.3
Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface)
A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate a transaction, allowing them to access but not mod…
-
Medium 4.3
OData meta-data property entity tampering in SAP Field Logistics
SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availabi…
-
Medium 4.3
Authorization Bypass vulnerability in SAP NetWeaver
SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the ABAP system, the attacker can run a specific transaction that exposes sensitiv…
-
Medium 4.3
Odata meta-data tampering in SAP S4CORE entity
SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability is not impacted.
-
Medium 4.2
Information Disclosure Vulnerability in SAP Commerce Cloud
Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing …
-
Medium 4.1
Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output varia…
-
Low 3.5
Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center)
Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby com…
Revision history
-
#2
Update von SAP - CVE-2025-31324 (ausgenutzt), CVE-2025-31327, CVE-2025-31328 ergänzt
-
#1
Initiale Fassung
References
-
April Patch Day Notes vom 2025-04-07
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html
-
April Patch Day Notes Update vom 2025-04-24
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html
-
National Vulnerability Database CVE-2025-31324
https://nvd.nist.gov/vuln/detail/CVE-2025-31324
-
Security Online vom 2025-04-24
https://securityonline.info/cve-2025-31324-cvss-10-zero-day-in-sap-netweaver-exploited-in-the-wild-to-deploy-webshells-and-c2-frameworks/