Description
SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on confidentiality and minimal impact on integrity and availability of the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP S/4HANA (Private Cloud & On-Premise) | S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714 | — |
Advisories 2
- WID-SEC-2025-1002 SAP Patchday Mai 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 13, 2025
- NCSC-2025-0149 Kwetsbaarheden verholpen in SAP producten NCSC-NL (Netherlands) · May 13, 2025