CVE-2025-42952

Description

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially rendering the system unusable. On successful exploitation, an attacker can render the system unusable by triggering short dumps on login. This could cause a high impact on availability. Data confidentiality and integrity are not affected. No data can be read, changed or deleted.

Reserved 2025-04-16 | Published 2025-07-08 | Updated 2025-07-08 | Assigner sap

Problem types

CWE-862: Missing Authorization

Product status

Default status
unaffected

PI_BASIS 2006_1_700
affected

701
affected

702
affected

731
affected

740
affected

SAP_BW 700
affected

750
affected

751
affected

752
affected

753
affected

754
affected

755
affected

756
affected

757
affected

758
affected

816
affected

References

me.sap.com/notes/3623255

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42952)

nvd.nist.gov (CVE-2025-42952)

Download JSON