{"id":"CVE-2025-42947","state":"PUBLISHED","title":"Code Injection vulnerability in SAP FICA ODN framework","description":"SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on confidentiality of the application.","publishedAt":"2025-07-23T03:25:10.245Z","updatedAt":"2025-07-23T15:20:22.443Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","source":"sap"},"assigner":"sap","products":["SAP_SE SAP FICA ODN framework"],"affected":[{"vendor":"SAP_SE","product":"SAP FICA ODN framework","defaultStatus":"unaffected","versions":[{"version":"SAPSCORE 132","status":"affected"},{"version":"S4CORE 102","status":"affected"},{"version":"103","status":"affected"},{"version":"104","status":"affected"},{"version":"105","status":"affected"},{"version":"106","status":"affected"},{"version":"107","status":"affected"},{"version":"108","status":"affected"},{"version":"FI-CA 606","status":"affected"},{"version":"616","status":"affected"},{"version":"617","status":"affected"},{"version":"618","status":"affected"}]}],"references":["https://me.sap.com/notes/3540688","https://url.sap/sapsecuritypatchday"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:09:17.366Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/42xxx/CVE-2025-42947.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-42947","state":"PUBLISHED","datePublished":"2025-07-23T03:25:10.245Z","dateUpdated":"2025-07-23T15:20:22.443Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2025-04-16T13:25:37.188Z"},"containers":{"cna":{"title":"Code Injection vulnerability in SAP FICA ODN framework","descriptions":[{"lang":"en","value":"SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on confidentiality of the application."}],"affected":[{"vendor":"SAP_SE","product":"SAP FICA ODN framework","defaultStatus":"unaffected","versions":[{"version":"SAPSCORE 132","status":"affected"},{"version":"S4CORE 102","status":"affected"},{"version":"103","status":"affected"},{"version":"104","status":"affected"},{"version":"105","status":"affected"},{"version":"106","status":"affected"},{"version":"107","status":"affected"},{"version":"108","status":"affected"},{"version":"FI-CA 606","status":"affected"},{"version":"616","status":"affected"},{"version":"617","status":"affected"},{"version":"618","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3540688"},{"url":"https://url.sap/sapsecuritypatchday"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"CWE-94: Improper Control of Generation of Code","lang":"eng","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2025-07-23T03:25:10.245Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-23T15:12:53.797462Z","id":"CVE-2025-42947","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-23T15:20:22.443Z"}}]}}}