CVE-2025-42993
Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)
Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC destination, leading to code execution under the privileges of the assigned high-privilege user. While the vulnerability has a low impact on Availability, it significantly poses a high risk to both Confidentiality and Integrity.
Reserved 2025-04-16 | Published 2025-06-10 | Updated 2025-06-10 | Assigner sapCWE-862: Missing Authorization
Support options
