CVE-2025-42996

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing low impact on confidentiality, integrity and availibility of the application.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-590

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-429976.6Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the applicat CVE-2025-429985.3The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidd CVE-2025-429999.1SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when d CVE-2025-43009.8A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. Affected is an unknown function of the CVE-2025-430007.9Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This CVE-2025-430016.9SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or pr CVE-2025-430024.3SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. Th CVE-2025-430036.4SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI CVE-2025-430045.3Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to a CVE-2025-430054.3SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store use CVE-2025-430066.1SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in t CVE-2025-430076.3SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escala