Authorization Flaw in SAP Product Results in Data Exposure
CVE-2025-43008

5.8MEDIUM

Key Information:

Vendor

SAP
Status
SAP S/4hana Hcm Portugal And SAP Erp Hcm Portugal
Vendor
CVE Published:
13 May 2025

What is CVE-2025-43008?

An authorization check flaw within SAP's application allows unauthorized users to access files belonging to other companies. This can lead to the exposure of sensitive employee personal data. While the integrity and availability of the system are unaffected, the potential for privacy violations necessitates urgent remediation.

Affected Version(s)

SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal S4HCMCPT 100

SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal 101

SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal SAP_HRCPT 600

References

https://me.sap.com/notes/3585992
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.