CVE-2025-43002— Missing Authorization check in SAP S4/HANA (OData meta-data property)
Quick assessment
Affected
SAP_SE SAP S4/HANA (OData meta-data property)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP S4CORE是德国思爱普（SAP）公司的一个管理采购合同应用程序。 SAP S4CORE存在安全漏洞，该漏洞源于缺少授权检查，可能导致信息泄露。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-43002
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization check in SAP S4/HANA (OData meta-data property)
Source: CVE Program / CVE List V5
Vulnerability Description
SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. This could cause a low impact on confidentiality but integrity and availability of the application are not impacted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对假设不可变Web参数的外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
SAP S4CORE 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP S4CORE是德国思爱普（SAP）公司的一个管理采购合同应用程序。 SAP S4CORE存在安全漏洞，该漏洞源于缺少授权检查，可能导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP S4/HANA (OData meta-data property) | S4CORE 102 | - |
|
II. Public POCs for CVE-2025-43002
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-43002
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2025-05-13 · 20 CVEs total
| CVE-2025-30012 | 10.0 CRITICAL | Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) |
| CVE-2025-42999 | 9.1 CRITICAL | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) |
| CVE-2025-30018 | 8.6 HIGH | Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) |
| CVE-2025-43010 | 8.3 HIGH | Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master |
| CVE-2025-43000 | 7.9 HIGH | Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platfor |
| CVE-2025-43011 | 7.7 HIGH | Missing Authorization Check in SAP Landscape Transformation (PCL Basis) |
| CVE-2025-42997 | 6.6 MEDIUM | Information Disclosure vulnerability in SAP Gateway Client |
| CVE-2025-43003 | 6.4 MEDIUM | Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise) |
| CVE-2025-43007 | 6.3 MEDIUM | Missing Authorization check in SAP Service Parts Management (SPM) |
| CVE-2025-43009 | 6.3 MEDIUM | Missing Authorization check in SAP Service Parts Management (SPM) |
| CVE-2025-31329 | 6.2 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Pla |
| CVE-2025-43006 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master D |
| CVE-2025-30010 | 6.1 MEDIUM | Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) |
| CVE-2025-30009 | 6.1 MEDIUM | Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) |
| CVE-2025-43008 | 5.8 MEDIUM | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal |
| CVE-2025-43004 | 5.3 MEDIUM | Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator |
| CVE-2025-30011 | 5.3 MEDIUM | Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) |
| CVE-2025-26662 | 4.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console |
| CVE-2025-43005 | 4.3 MEDIUM | Information Disclosure vulnerability in SAP GUI for Windows |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapt -
CVE-2026-66779
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66776
Multiple vulnerabilities in SAP Business AI Platform (Approu
Same weakness: CWE-472
-
CVE-2026-67363
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tam -
CVE-2026-1982
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated -
CVE-2026-7484
Improper Access Control in Abis Technology's AVESİS -
CVE-2026-65052
Ninja Forms Calculation and Payment Total Tampering via Fail -
CVE-2026-56877
Skillable SCORM Lab Launch Integration 输入验证错误漏洞
V. Comments for CVE-2025-43002
No comments yet