SAP Security Notes Review: March 2025

[CVE-2025-25244] Missing Authorisation Check in SAP Business Warehouse (Process Chains) (SAP Note 3552144 )

SAP Business Warehouse (Process Chains) allows attackers to manipulate the process execution due to a missing authorisation check. An attacker with display authorisation for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting, leading to a significant impact on integrity. However, there is no impact on confidentiality or availability.

[CVE-2025-27430] Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center) (SAP note 3561861 )

Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application’s confidentiality.

[CVE-2025-25242] Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP) (SAP Note 3562390)

SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the application’s availability, but it can have some minor impact on its confidentiality and integrity.

[CVE-2025-26661] Missing Authorisation check in SAP NetWeaver (ABAP Class Builder) (SAP Note 3563927)

Due to missing authorisation checks, SAP NetWeaver (ABAP Class Builder) allows attackers to gain higher access levels than they should have, escalating privileges. This could result in the disclosure of highly sensitive information on successful exploitation. It could also greatly impact the integrity and availability of the application.

[CVE-2025-27432] Missing Authorisation check in SAP Electronic Invoicing for Brazil (eDocument Cockpit) (SAP Note 3568865)

The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorised access to each transaction. An unauthorised attacker could call each transaction and view the inbound delivery details by executing the specific ABAP method within the ABAP system. This vulnerability has a low impact on confidentiality and no effect on the integrity and availability of the application.