CVE-2025-42951

Published Aug 12, 2025

Last updated 4 months ago

CVSS high 8.8
SAP

Overview

Description
Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result , it has a high impact on the confidentiality, integrity, and availability of the application.
Source
cna@sap.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.8
Impact score
5.9
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

cna@sap.com
CWE-863

Social media

Hype score
Not currently trending

  1. CVE-2025-42951 (CVSS:8.8, HIGH) is Awaiting Analysis. Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of..https://t.co/Fwntn7kj2U #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    @cracbot

    17 Aug 2025

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. ⚠️Actualización de seguridad de SAP ❗CVE-2025-42957 ❗CVE-2025-42950 ❗CVE-2025-42951 ➡️Más info: https://t.co/jxqwH2t7xx https://t.co/jGRCP6KPvz

    @CERTpy

    13 Aug 2025

    101 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-42951 Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.… https://t.co/wQvUC4I7oO

    @CVEnew

    12 Aug 2025

    344 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. [CVE-2025-42951: HIGH] Broken authorization in SAP Business One (SLD) enables attackers to gain database admin privileges, impacting confidentiality, integrity, and availability. #cybersecurity#cve,CVE-2025-42951,#cybersecurity https://t.co/qMTSJ44d6N https://t.co/9SffUOyuAc

    @CveFindCom

    12 Aug 2025

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-58231
  2. SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.•CVE-2026-34265
  3. SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-44758
  4. SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.•CVE-2026-44761
  5. Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.•CVE-2026-27690

References

Sources include official advisories and independent security research.