Home

Description

SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites' configuration by injecting line feed (LF) characters into application inputs. This vulnerability has a low impact on the application's integrity and no impact on confidentiality or availability.

PUBLISHED Reserved 2025-04-16 | Published 2025-08-12 | Updated 2025-08-12 | Assigner sap




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers

Product status

Default status
unaffected

S4CORE 102
affected

103
affected

104
affected

105
affected

106
affected

107
affected

108
affected

109
affected

References

me.sap.com/notes/3616863

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42934)

nvd.nist.gov (CVE-2025-42934)

Download JSON