CVE-2025-42987

SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - cna@sap.com

Published

2025-06-10

Last modified

2025-06-10

Weaknesses

CWE-862

Affected products

• Sap S4hana Manage Processing Rules - For Bank Statement (Sap Se)

References

• https://me.sap.com/notes/3596850
• https://url.sap/sapsecuritypatchday