CVE-2025-42939 — Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements)

CVE-2025-42939

Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements) PUBLISHED

Description (CNA)

SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the application without affecting its confidentiality or availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA (Manage Processing Rules - For Bank Statements)	affected S4CORE 104; affected 105; affected 106; affected 107; affected 108; affected 109

CWE

CWE-863

References

https://me.sap.com/notes/3625683
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.