Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2025-42967

Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new report with his own code potentially gaining full control of the affected SAP system causing high impact on confidentiality, integrity, and availability of the application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP S/4HANA and SAP SCM (Characteristic Propagation)

Default version status: unaffected

  • SCMAPO 713affected
  • 714affected
  • S4CORE 102affected
  • 103affected
  • 104affected
  • S4COREOP 105affected
  • 106affected
  • 107affected
  • 108affected
  • SCM 700affected
  • 701affected
  • 702affected
  • 712affected

References