CVE-2025-42984 MEDIUM

CVE-2025-42984: Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application)

Vendor Sap_Se
Product SAP S/4HANA (Manage Central Purchase Contract application)
Weakness CWE-862 · Missing authorization
Published June 10, 2025
Last update June 10, 2025
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

What the vulnerability does

01Description

SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user. Due to this, an attacker could execute the function import on the entity making it inaccessible for unrestricted user. This has low impact on confidentiality and availability of the application.

Key dates

02Disclosure timeline

June 10, 2025 CVE published
June 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-30470 WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability CVE-2025-13950 OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update CVE-2025-22561 WordPress Title Experiments Free plugin <= 9.0.4 - Broken Access Control vulnerability CVE-2025-66166 WordPress Lottier for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability CVE-2026-0974 Orderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation