CVE-2025-27430 — Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center)

Description (CNA)

Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's confidentiality. There is no impact on integrity or availability

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP CRM and SAP S/4HANA (Interaction Center)	affected S4CRM 100; affected 200; affected 204; affected 205; affected 206; affected S4FND 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108; affected S4CEXT 107; affected BBPCRM 701; affected 702; affected 712; affected 713; affected 714; affected WEBCUIF 701; affected 731; affected 746; affected 747; affected 748; affected 800; affected 801

CWE

CWE-918

References

https://me.sap.com/notes/3561861
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.