CVE-2025-42912

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-429133.1Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowle CVE-2025-429143.1Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowle CVE-2025-429155.4Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abus CVE-2025-429168.1Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database table CVE-2025-429176.5SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in esc CVE-2025-429184.3SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access t CVE-2025-429195.3Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manip CVE-2025-42925.4A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of t CVE-2025-429206.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a CVE-2025-429216.5In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin CVE-2025-429229.9SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbit CVE-2025-429234.3Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to sen