Log in Start free

Vulnerability · Published Oct 14, 2025 · Assigned by sap

CVE-2025-42939Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements)

Medium 4.3

In plain English

A medium-severity incorrect authorization in SAP S/4HANA (Manage Processing Rules - For Bank Statements) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the application without affecting its confidentiality or availability.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP S/4HANA (Manage Processing Rules - For Bank Statements) S4CORE 104105106107108109

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References