CVE-2025-43003 — Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)

CVE-2025-43003

Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise) PUBLISHED

Description (CNA)

SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on confidentiality and minimal impact on integrity and availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA (Private Cloud & On-Premise)	affected S4CRM 204; affected 205; affected 206; affected S4CEXT 107; affected 108; affected BBPCRM 702; affected 712; affected 713; affected 714

CWE

CWE-749

References

https://me.sap.com/notes/3596033
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.