CVE-2025-42903

MediumCVSS 4.3/10Last modified Oct 8, 2026

Description

A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-429046.5Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed inCVE-2025-429065.3SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration ConsolCVE-2025-429074.3SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browserCVE-2025-429085.4Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiCVE-2025-429093.0SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in anCVE-2025-42919.8A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leaCVE-2025-429109.0Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitraCVE-2025-429114.3SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to infCVE-2025-429126.5SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalatioCVE-2025-429133.1Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowleCVE-2025-429143.1Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowleCVE-2025-429155.4Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abus