SAP Security Notes, March 2025

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.

March 2025 Notes

Summary and Highlights of the Month

Full details

The complete detail of the most relevant notes is as follows:

1. Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI) (3569602): Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce. It is important to note that other components of SAP Commerce are not affected and significant user interaction is required for this to materialize. Switching starter themes eliminates the risk of this attack by removing the explore feature of Swagger UI which was vulnerable to the DOM-based XSS attack. The vulnerable DOM element is no longer rendered on Swagger UI. There is a Work around. CVSS v3 Base Score 8,8/ 10 [CVE-2025-27434]
2. Missing Authorization check in SAP NetWeaver (ABAP Class Builder) (3563927): Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application. By this correction functionality restricted to the ABAP Development, workbench is excluded from execution by transaction SA38. There isn’t a workaround CVSS v3 Base Score 8,8/ 10 [CVE-2025-26661] 
3.  Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud (3566851): SAP Commerce Cloud uses a version of Apache Tomcat that could be vulnerable to DOS (CVE-2024-38286) and unchecked error conditions (CVE-2024-52316). For these vulnerabilities, prerequisites must apply first, as elaborated in the CVEs. To fix this vulnerability you have to update Apache Tomcat to versions not vulnerable to these CVEs. CVSS v3 Base Score 8,6/ 10 [CVE-2024-38286] 
    
4.  Update – Authentication bypass via authorization code injection in SAP Approuter (3567974):  The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application. To fix the error, please upgrade to SAP Approuter node.js package to 16.7.2 or higher. This fix ensures that the url protocol in the login callback url is a valid one. CVSS v3 Base Score 8,1/ 10 [CVE-2025-24876] 
5. Update – Missing Authorization check in SAP PDCE (3483344): Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application. When this note is aplied, the affected functions have now been deactivated to restrict accesses. CVSS v3 Base Score 7,6/ 10 [CVE-2024-39592]

Reference links

Other references, from SAP and Onapsis (march):

SAP Security Patch Day – March 2025

SAP Patch Day: March 2025 – Onapsis

Resources affected