Vulnerability · Published Jun 10, 2025 · Assigned by sap
CVE-2025-42998Security misconfiguration vulnerability in SAP Business One Integration Framework
Medium 5.3
In plain English
A medium-severity security flaw in SAP Business One Integration Framework from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Business One Integration Framework | B1_ON_HANA 10.0SAP-M-BO 10.0 |
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N