CVE-2025-42903 — User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management

CVE-2025-42903

User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management PUBLISHED

Description (CNA)

A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Financial Service Claims Management	affected INSURANCE 803; affected 804; affected 805; affected 806; affected S4CEXT 107; affected 108; affected 109

CWE

CWE-204

References

https://me.sap.com/notes/3656781
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.