Log in Start free

Vulnerability · Published May 13, 2025 · Assigned by sap

CVE-2025-43010Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

High 8.3

In plain English

A high-severity code injection in SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation and no authorization checks. This has low Confidentiality impact but high impact on integrity and availability to the application.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) S4CORE 102103104105106107108SCM_BASIS 700

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

References