CVE-2025-42993: Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)
Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC destination, leading to code execution under the privileges of the assigned high-privilege user. While the vulnerability has a low impact on Availability, it significantly poses a high risk to both Confidentiality and Integrity.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-42993?
CVE-2025-42993 is considered a critical severity vulnerability due to the potential for unauthorized access to high-privilege functionalities.
How do I fix CVE-2025-42993?
To fix CVE-2025-42993, implement the latest security patches from SAP and ensure proper authorization checks are configured.
What are the risks associated with CVE-2025-42993?
The risks of CVE-2025-42993 include unauthorized creation of RFC destinations, leading to potential data breaches and system manipulation.
Which versions of SAP S/4HANA are affected by CVE-2025-42993?
CVE-2025-42993 affects all versions of SAP S/4HANA that are not updated with the latest security patches.
Can CVE-2025-42993 be exploited remotely?
Yes, CVE-2025-42993 can be exploited remotely by attackers with access to the Inbound Binding Configuration.