Vulnerability · Published Sep 9, 2025 · Assigned by sap
CVE-2025-42915Missing Authorization Check in Fiori app (Manage Payment Blocks)
Medium 5.4
In plain English
A medium-severity missing authorization in Fiori app (Manage Payment Blocks) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities that should be restricted to specific user groups.This issue could impact both the confidentiality and integrity of the application without affecting the availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | Fiori app (Manage Payment Blocks) | S4CORE 107108 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N