Vulnerability · Published Jun 10, 2025 · Assigned by sap
CVE-2025-42987Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement)
Medium 4.3
In plain English
A medium-severity missing authorization in SAP S/4HANA (Manage Processing Rules - For Bank Statement) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 86.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP S/4HANA (Manage Processing Rules - For Bank Statement) | S4CORE 104105106107108 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N