{"id":"CVE-2025-42998","state":"PUBLISHED","title":"Security misconfiguration vulnerability in SAP Business One Integration Framework","description":"The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.","publishedAt":"2025-06-10T00:14:11.037Z","updatedAt":"2025-06-10T15:14:57.460Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"sap"},"assigner":"sap","products":["SAP_SE SAP Business One Integration Framework"],"affected":[{"vendor":"SAP_SE","product":"SAP Business One Integration Framework","defaultStatus":"unaffected","versions":[{"version":"B1_ON_HANA 10.0","status":"affected"},{"version":"SAP-M-BO 10.0","status":"affected"}]}],"references":["https://me.sap.com/notes/3594258","https://url.sap/sapsecuritypatchday"],"weaknesses":["CWE-346"],"ingestedAt":"2026-10-29T20:09:17.366Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/42xxx/CVE-2025-42998.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-42998","state":"PUBLISHED","datePublished":"2025-06-10T00:14:11.037Z","dateUpdated":"2025-06-10T15:14:57.460Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2025-04-16T13:25:50.942Z"},"containers":{"cna":{"title":"Security misconfiguration vulnerability in SAP Business One Integration Framework","descriptions":[{"lang":"en","value":"The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability."}],"affected":[{"vendor":"SAP_SE","product":"SAP Business One Integration Framework","defaultStatus":"unaffected","versions":[{"version":"B1_ON_HANA 10.0","status":"affected"},{"version":"SAP-M-BO 10.0","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3594258"},{"url":"https://url.sap/sapsecuritypatchday"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-346","description":"CWE-346: Origin Validation Error","lang":"eng","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2025-06-10T00:14:11.037Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-10T13:37:46.034577Z","id":"CVE-2025-42998","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-10T15:14:57.460Z"}}]}}}