{"id":"CVE-2025-42929","state":"PUBLISHED","title":"Missing input validation vulnerability in SAP Landscape Transformation Replication Server","description":"Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database.","publishedAt":"2025-09-09T02:10:59.447Z","updatedAt":"2025-09-09T13:56:41.986Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","source":"sap"},"assigner":"sap","products":["SAP_SE SAP Landscape Transformation Replication Server"],"affected":[{"vendor":"SAP_SE","product":"SAP Landscape Transformation Replication Server","defaultStatus":"unaffected","versions":[{"version":"DMIS 2011_1_620","status":"affected"},{"version":"2011_1_640","status":"affected"},{"version":"2011_1_700","status":"affected"},{"version":"2011_1_710","status":"affected"},{"version":"2011_1_730","status":"affected"},{"version":"2011_1_731","status":"affected"},{"version":"2011_1_752","status":"affected"},{"version":"2020","status":"affected"}]}],"references":["https://me.sap.com/notes/3633002","https://url.sap/sapsecuritypatchday"],"weaknesses":["CWE-1287"],"ingestedAt":"2026-10-29T20:09:17.366Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/42xxx/CVE-2025-42929.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-42929","state":"PUBLISHED","datePublished":"2025-09-09T02:10:59.447Z","dateUpdated":"2025-09-09T13:56:41.986Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2025-04-16T13:25:32.385Z"},"containers":{"cna":{"title":"Missing input validation vulnerability in SAP Landscape Transformation Replication Server","descriptions":[{"lang":"en","value":"Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database."}],"affected":[{"vendor":"SAP_SE","product":"SAP Landscape Transformation Replication Server","defaultStatus":"unaffected","versions":[{"version":"DMIS 2011_1_620","status":"affected"},{"version":"2011_1_640","status":"affected"},{"version":"2011_1_700","status":"affected"},{"version":"2011_1_710","status":"affected"},{"version":"2011_1_730","status":"affected"},{"version":"2011_1_731","status":"affected"},{"version":"2011_1_752","status":"affected"},{"version":"2020","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3633002"},{"url":"https://url.sap/sapsecuritypatchday"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1287","description":"CWE-1287: Improper Validation of Specified Type of Input","lang":"eng","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2025-09-09T02:10:59.447Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-09T13:56:24.949485Z","id":"CVE-2025-42929","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-09T13:56:41.986Z"}}]}}}