CVE-2025-42923

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server. This has low impact on integrity and no impact on confidentiality and availability of the application.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-429246.1SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redCVE-2025-429254.3Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low CVE-2025-429265.3SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within theCVE-2025-429273.4SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of knoCVE-2025-429289.1Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code executiCVE-2025-429298.1Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tableCVE-2025-42935.4A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /adCVE-2025-429306.5SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters thatCVE-2025-429338.8When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leaCVE-2025-429344.3SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untCVE-2025-429354.1The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privileCVE-2025-429365.4The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user rol