CVE-2025-43009 — Missing Authorization check in SAP Service Parts Management (SPM)

CVE-2025-43009

Missing Authorization check in SAP Service Parts Management (SPM) PUBLISHED

Description (CNA)

SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on Confidentiality, integrity and availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Service Parts Management (SPM)	affected SAP_APPL 600; affected 602; affected 603; affected 604; affected 605; affected 606; affected 616; affected 617; affected 618; affected S4CORE 100; affected 101; affected 102

CWE

CWE-862

References

https://me.sap.com/notes/2491817
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.