CVE-2025-42959
Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476
An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation could result in complete system compromise, affecting confidentiality, integrity, and availability.
Reserved 2025-04-16 | Published 2025-07-08 | Updated 2025-07-08 | Assigner sapCWE-308: Use of Single-factor Authentication
Support options
