Riskcovery

CVE-2025-43010

Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

State
Published
Severity
8.3 High
Published
May 13, 2025
Updated
May 13, 2025
Reserved
Apr 16, 2025

Read the record on cve.org

Description

SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation and no authorization checks. This has low Confidentiality impact but high impact on integrity and availability to the application.

Scores

CVSSScoreVectorSource
3.18.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:Hsap

Weaknesses

  • CWE-94 Improper Control of Generation of Code

Affected Products

ProductVersions
SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL))SAP_SE
  • S4CORE 102Affected
  • 103Affected
  • 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected
  • SCM_BASIS 700Affected
  • 701Affected
  • 702Affected
  • 712Affected
  • 713Affected
  • 714Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.