Command Injection Vulnerability in SAP ERP BW Business Content
CVE-2025-30013

6.7MEDIUM

Key Information:

Vendor
SAP
Status
SAP Erp Bw Business Content
Vendor
CVE Published:
8 April 2025

Summary

SAP ERP BW Business Content has a vulnerability that allows OS Command Injection through certain function modules. When these modules are executed with elevated privileges, they fail to properly validate user input, enabling attackers to inject and execute arbitrary OS commands. This presents a critical risk to the confidentiality, integrity, and availability of the affected systems, highlighting the need for immediate attention and remediation.

Affected Version(s)

SAP ERP BW Business Content BI_CONT 707

SAP ERP BW Business Content 737

SAP ERP BW Business Content 747

References

https://me.sap.com/notes/3571093
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.