Vulnerability · Published Sep 9, 2025 · Assigned by sap
CVE-2025-42930Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation
Medium 6.5
In plain English
A medium-severity security flaw in SAP Business Planning and Consolidation from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 72.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there is no impact on confidentiality or integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Business Planning and Consolidation | BPC4HANA 200300SAP_BW 750751752753754755 |
Weakness: CWE-606 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H