CVE-2025-42916

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 5.8

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3635475
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Debido a la falta de validación de entrada, un atacante con acceso de altos privilegios a informes ABAP podría eliminar el contenido de tablas de base de datos arbitrarias, si las tablas no están protegidas por un grupo de autorización. Esto conlleva un alto impacto en la integridad y disponibilidad de la base de datos pero ningún impacto en la confidencialidad.

Information

Published : 2025-09-09 02:15

Updated : 2026-09-30 23:10

NVD link : CVE-2025-42916

Mitre link : CVE-2025-42916

CVE.ORG link : CVE-2025-42916

JSON object : View

Products Affected

No product.

CWE

CWE-1287

Improper Validation of Specified Type of Input

{"id": "CVE-2025-42916", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-42916", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-09T13:47:20.018166Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 1.7}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP S/4HANA (Private Cloud or On-Premise)", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-09T02:15:39.717", "references": [{"url": "https://me.sap.com/notes/3635475", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-1287"}]}], "descriptions": [{"lang": "en", "value": "Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality."}, {"lang": "es", "value": "Debido a la falta de validaci\u00f3n de entrada, un atacante con acceso de altos privilegios a informes ABAP podr\u00eda eliminar el contenido de tablas de base de datos arbitrarias, si las tablas no est\u00e1n protegidas por un grupo de autorizaci\u00f3n. Esto conlleva un alto impacto en la integridad y disponibilidad de la base de datos pero ning\u00fan impacto en la confidencialidad."}], "lastModified": "2026-09-30T23:10:00.237", "sourceIdentifier": "cna@sap.com"}