CVE-2025-30016— Authentication Bypass Vulnerability in SAP Financial Consolidation
Quick assessment
Affected
SAP_SE SAP Financial Consolidation
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Financial Consolidation是德国思爱普（SAP）公司的一套财务报表解决方案。该产品主要用于自动化公司间对账和抵销、货币换算并提供财务报表生成等功能。 SAP Financial Consolidation存在安全漏洞，该漏洞源于认证机制不当，可能导致未授权访问Admin账户。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-30016
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authentication Bypass Vulnerability in SAP Financial Consolidation
Source: CVE Program / CVE List V5
Vulnerability Description
SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authentication mechanisms, due to which there is high impact on the Confidentiality, Integrity & Availability of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在没有访问控制机制中存储敏感数据
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Financial Consolidation 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Financial Consolidation是德国思爱普（SAP）公司的一套财务报表解决方案。该产品主要用于自动化公司间对账和抵销、货币换算并提供财务报表生成等功能。 SAP Financial Consolidation存在安全漏洞，该漏洞源于认证机制不当，可能导致未授权访问Admin账户。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Financial Consolidation | FINANCE 1010 | - |
|
II. Public POCs for CVE-2025-30016
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-30016
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2025-04-08 · 17 CVEs total
| CVE-2025-31330 | 9.9 CRITICAL | Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) |
| CVE-2025-27429 | 9.9 CRITICAL | Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise) |
| CVE-2025-23186 | 8.5 HIGH | Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetW |
| CVE-2025-30014 | 7.7 HIGH | Directory Traversal vulnerability in SAP Capital Yield Tax Management |
| CVE-2025-27428 | 7.7 HIGH | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collect |
| CVE-2025-26654 | 6.8 MEDIUM | Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud) |
| CVE-2025-30013 | 6.7 MEDIUM | Code Injection vulnerability in SAP ERP BW Business Content |
| CVE-2025-31332 | 6.6 MEDIUM | Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platf |
| CVE-2025-26657 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP KMC WPC |
| CVE-2025-26653 | 4.7 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applica |
| CVE-2025-30017 | 4.4 MEDIUM | Missing Authorization check in SAP Solution Manager |
| CVE-2025-31333 | 4.3 MEDIUM | Odata meta-data tampering in SAP S4CORE entity |
| CVE-2025-31331 | 4.3 MEDIUM | Authorization Bypass vulnerability in SAP NetWeaver |
| CVE-2025-27437 | 4.3 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface |
| CVE-2025-27435 | 4.2 MEDIUM | Information Disclosure Vulnerability in SAP Commerce Cloud |
| CVE-2025-30015 | 4.1 MEDIUM | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABA |
IV. Related Vulnerabilities
Same product: SAP Financial Consolidation
-
CVE-2026-40136
Denial of service (DoS) in SAP Financial Consolidation -
CVE-2024-37178
Cross-Site Scripting (XSS) vulnerabilities in SAP Financial -
CVE-2024-37177
Cross-Site Scripting (XSS) vulnerabilities in SAP Financial -
CVE-2022-41260
SAP Financial Consolidation 跨站脚本漏洞 -
CVE-2022-41208
SAP Financial Consolidation 跨站脚本漏洞
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-921
-
CVE-2025-24843
Dario Health USB-C Blood Glucose Monitoring System Starter K -
CVE-2025-24870
Insecure Key & Secret Management vulnerability in SAP GUI fo -
CVE-2024-5206
Sensitive Data Leakage in sklearn.feature_extraction.text.Tf -
CVE-2023-41818
Motorola Device Help 安全漏洞 -
CVE-2023-41965
Socomec MOD3GP-SY-120K Insecure Storage of Sensitive Informa
V. Comments for CVE-2025-30016
No comments yet