CVE-2025-42967 — Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)

Description (CNA)

SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new report with his own code potentially gaining full control of the affected SAP system causing high impact on confidentiality, integrity, and availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA and SAP SCM (Characteristic Propagation)	affected SCMAPO 713; affected 714; affected S4CORE 102; affected 103; affected 104; affected S4COREOP 105; affected 106; affected 107; affected 108; affected SCM 700; affected 701; affected 702; affected 712

CWE

CWE-94

References

https://me.sap.com/notes/3618955
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.