CVE-2025-42987 — Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement)

CVE-2025-42987

Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement) PUBLISHED

Description (CNA)

SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA (Manage Processing Rules - For Bank Statement)	affected S4CORE 104; affected 105; affected 106; affected 107; affected 108

CWE

CWE-862

References

https://me.sap.com/notes/3596850
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.