CVE-2025-42943
Information Disclosure in SAP GUI for Windows
- State
- Published
- Severity
- 4.5 Medium
- Published
- Aug 12, 2025
- Updated
- Aug 12, 2025
- Reserved
- Apr 16, 2025
Description
SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. For a successful attack, the attacker needs developer authorization in a specific Application Server ABAP to make changes in the code, and the victim needs to execute by using SAP GUI for Windows. This could trigger automatic NTLM authentication, potentially exposing hashed credentials to an attacker. As a result, it has a high impact on the confidentiality.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N | sap |
Weaknesses
- CWE-250 Execution with Unnecessary Privileges
Affected Products
| Product | Versions |
|---|---|
SAP GUI for WindowsSAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.