CVE-2025-30013
Code Injection vulnerability in SAP ERP BW Business Content
- State
- Published
- Severity
- 6.7 Medium
- Published
- Apr 8, 2025
- Updated
- Feb 26, 2026
- Reserved
- Mar 13, 2025
Description
SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintended commands on the underlying system, posing a significant security risk to the confidentiality, integrity and availability of the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.7 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | sap |
Weaknesses
- CWE-94 Improper Control of Generation of Code
Affected Products
| Product | Versions |
|---|---|
SAP ERP BW Business ContentSAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.