Vulnerability · Published May 13, 2025 · Assigned by sap

CVE-2025-43003Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)

Medium 6.4

In plain English

A medium-severity security flaw in SAP S/4HANA (Private Cloud & On-Premise) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 74.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on confidentiality and minimal impact on integrity and availability of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP S/4HANA (Private Cloud & On-Premise)	S4CRM 204205206S4CEXT 107108BBPCRM 702712713

Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

In plain English

Official description

Affected products (as reported)

References