SAP Security Notes, February 2025

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.

February 2025 Notes

Summary and Highlights of the Month

Full details

The complete detail of the most relevant notes is as follows:

1.  Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application) (3417627): The User Admin application of SAP NetWeaver AS for Java – version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability. This error can be solved by applying the correction according to the “Validity” and “Support Packages & Patches” sections of this note. Note: To avoid incompatibilities on the system, check SAP Note 1974464 – Information on SCA Dependency Analysis for Java download objects. CVSS v3 Base Score 8,8/ 10 [CVE-2024-22126]
2. Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console) (3525794): Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability. To solve the issue, please implement the patches listed in “Support Packages & Patches” section of this Security Note.For Business Intelligence Platform maintenance schedule and strategy see the Knowledge Base Article 2144559 in References section. Besides, after upgrading to the patches in this Security Note, configure the system with HTTPS as described in the product documentation referenced in this note, such as the Securing the BI Platform section of the Business Intelligence Platform Administrator Guide (subsection Trusted Authentication).  It is highly recommended (but not mandatory) to configure the system with CORBA SSL as explained in the same section Configuring backend servers for SSL. For implementation steps and further details see SAP KBA 3559381.  CVSS v3 Base Score 8,7/ 10 [CVE-2025-0064] 
3.  Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) (3567551): SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability. This issue exists due to the programmatic error of insufficient sanitization of input path. To solve the issue, please implement the patches listed in “Support Packages & Patches” section of this Security Note. CVSS v3 Base Score 8,6/ 10 [CVE-2025-25243] 
4.  Authentication bypass via authorization code injection in SAP Approuter (3567974): The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application. To fix the error, please upgrade to SAP Approuter node.js package to 16.7.2 or higher. This fix ensures that the url protocol in the login callback url is a valid one. CVSS v3 Base Score 8,1/ 10 [CVE-2025-24876] 
5. Multiple vulnerabilities in SAP Enterprise Project Connection (3567172):  SAP Enterprise Project Connection uses versions of Spring Framework open-source libraries which could be vulnerable to CVEs mentioned in the “Other terms” section of this SAP Security Note. To solve this issue, implement the patch referenced by this SAP Security Note. By implementing this patch, above mentioned CVEs are fixed by upgrading to the relevant Spring framework libraries. CVSS v3 Base Score 7,5/ 10 [CVE-2024-38819]
6. Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services) (3563929): The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system. To fix the error, please implement the Support Packages and Patches referenced by this SAP Note. Validation of redirect URLs is applied in UAA for SAP HANA XS advanced model. The fix is available since SAP HANA XSA version 1.3.3. CVSS v3 Base Score 7,1/ 10 [CVE-2025-24868]

Reference links

Other references, from SAP and Onapsis (february):

SAP Security Patch Day – February 2025

SAP Patch Day: February 2025 – Onapsis

Resources affected