CVE-2025-42903: User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management
A vulnerability in SAP Financial Service Claims Management RFC function ICLUSERGETNAMEANDADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-42903?
CVE-2025-42903 has a low impact on confidentiality due to potential user enumeration and personal data disclosure.
How do I fix CVE-2025-42903?
To mitigate CVE-2025-42903, update your SAP Financial Service Claims Management to the latest version as per SAP security guidelines.
What causes CVE-2025-42903?
CVE-2025-42903 is caused by discrepancies in response data from the ICL_USER_GET_NAME_AND_ADDRESS RFC function.
Who is affected by CVE-2025-42903?
Users of SAP Financial Service Claims Management that utilize the affected RFC function are susceptible to CVE-2025-42903.
What type of data is at risk in CVE-2025-42903?
CVE-2025-42903 poses a risk of disclosing personal data due to user enumeration vulnerabilities.