Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2025-43010

Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation and no authorization checks. This has low Confidentiality impact but high impact on integrity and availability to the application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL))

Default version status: unaffected

  • S4CORE 102affected
  • 103affected
  • 104affected
  • 105affected
  • 106affected
  • 107affected
  • 108affected
  • SCM_BASIS 700affected
  • 701affected
  • 702affected
  • 712affected
  • 713affected
  • 714affected

References