CVE-2025-42987 MEDIUM

CVE-2025-42987: Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement)

Vendor Sap_Se
Product SAP S/4HANA (Manage Processing Rules - For Bank Statement)
Weakness CWE-862 · Missing authorization
Published June 10, 2025
Last update June 10, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application.

Key dates

02Disclosure timeline

June 10, 2025 CVE published
June 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-52801 WordPress TheBooking Plugin <= 1.4.4 - Broken Access Control Vulnerability CVE-2025-11833 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure CVE-2023-36526 WordPress Duplicate Post Page Menu & Custom Post Type plugin <= 2.4.1 - Broken Access Control vulnerability CVE-2026-8976 RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions CVE-2024-42376 Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework