Description
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP Approuter Node.js package | 2.6.1 to 16.7.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @sap/approuter | >= 2.6.1, < 16.7.2 | 16.7.2 | GHSA-cpfx-964w-4jvp |
Advisories 4
- NCSC-2025-0076 Kwetsbaarheden verholpen in SAP software NCSC-NL (Netherlands) · Mar 11, 2025
- WID-SEC-2025-0521 SAP Patchday März 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 10, 2025
- NCSC-2025-0045 Kwetsbaarheden verholpen in SAP producten NCSC-NL (Netherlands) · Feb 11, 2025
- WID-SEC-2025-0307 SAP Patchday Februar 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 10, 2025