CVE-2025-42984

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user. Due to this, an attacker could execute the function import on the entity making it inaccessible for unrestricted user. This has low impact on confidentiality and availability of the application.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
SAP_SESAP S/4HANA (Manage Central Purchase Contract application)S4CORE 106; 107; 108

References

Timeline

Published
Jun 10, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-429856.1Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and executCVE-2025-429864.3Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker couldCVE-2025-429874.3SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the CVE-2025-429885.3Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpointsCVE-2025-429899.6RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On CVE-2025-42999.8A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been rated as critical. This issue affects the function setSchedWifi of CVE-2025-429903.0Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirCVE-2025-429914.3SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to deleCVE-2025-429926.9SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to explCVE-2025-429936.7Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound BindCVE-2025-429947.5SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation iCVE-2025-429957.5SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the