CVE-2025-25244: Missing Authorization Check in SAP Business Warehouse (Process Chains)
SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting leading to a significant impact on integrity. However, there is no impact on confidentiality or availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25244?
CVE-2025-25244 is classified as a medium-severity vulnerability that affects SAP Business Warehouse due to a lack of proper authorization checks.
How do I fix CVE-2025-25244?
To fix CVE-2025-25244, ensure that appropriate authorization checks are implemented for process chain execution in SAP Business Warehouse.
Who is affected by CVE-2025-25244?
Any organization using SAP Business Warehouse with improperly configured authorization settings could be affected by CVE-2025-25244.
What could an attacker do with CVE-2025-25244?
An attacker could manipulate process executions by skipping crucial activities in SAP Business Warehouse if they have display authorization.
Is there a workaround for CVE-2025-25244?
Currently, the best workaround for CVE-2025-25244 is to review and restrict display authorization permissions for process chain objects.