Notas de Seguridad SAP, Abril 2025

Inprosec a través de sus servicios, como el SAP Security Assessment, ayuda a sus clientes a mejorar los niveles de seguridad de sus sistemas SAP.

Notas abril 2025

Resumen y highlights del Mes

Detalle completo

El detalle completo de las notas más relevantes es el siguiente (en inglés):

1. Code Injection Vulnerability in SAP S/4HANA (Private Cloud) (3581961): SAP S/4HANA has a vulnerability that allows a privileged attacker to inject arbitrary ABAP code through a function module exposed via RFC. This bypasses authorization checks and acts as a backdoor, compromising the system’s confidentiality, integrity, and availability, potentially leading to a full system takeover. CVSS v3 Base Score 9,9/ 10 [CVE-2025-27429]
2. Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) (3587115): SAP Landscape Transformation (SLT) has a vulnerability that allows an attacker with user privileges to inject arbitrary ABAP code through a function module exposed via RFC. This bypasses authorization checks and acts as a backdoor, compromising the system’s confidentiality, integrity, and availability, potentially leading to a full system takeover. CVSS v3 Base Score 9,9/ 10 [CVE-2025-31330]
3. Authentication Bypass Vulnerability in SAP Financial Consolidation (3572688) SAP Financial Consolidation has a vulnerability that allows an unauthenticated attacker to gain unauthorized access to the Admin account. This issue stems from improper authentication mechanisms, which significantly impact the Confidentiality, Integrity, and Availability of the application. CVSS v3 Base Score 9,8/ 10  [CVE-2025-30016]
4. Update –  Improper Authorization in SAP BusinessObjects Business Intelligence platform (3525794): Under specific conditions, SAP BusinessObjects Business Intelligence platform allows an attacker with user rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system by accessing the target system locally. This vulnerability has a high impact on the confidentiality, integrity, and availability of the application. Additionally, it requires manual activities. CVSS v3 Base Score 8,8/ 10  [CVE-2025-0064]
5. Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP (3554667): Under certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, potentially exposing credentials for a remote service. These credentials can then be exploited to completely compromise the remote service, which can significantly impact the confidentiality, integrity, and availability of the application. The note also includes a workaround.CVSS v3 Base Score 8,5/ 10  [CVE-2025-23186]
6. Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat within SAP Commerce Cloud (3590984): If successfully exploited, the vulnerability could fully compromise the system’s confidentiality, integrity, and availability. However, the success of this exploitation depends on a server setting that remains beyond the attacker’s control, and SAP Commerce is not exploitable out of the box. To resolve this, it is recommended to apply the recommended patches, as no workaround is available.( CVE-2024-56337 ).CVSS v3 Base Score 8,1/ 10 [CVE-2024-56337]
7. Directory Traversal vulnerability in SAP Capital Yield Tax Management (2927164): SAP Capital Yield Tax Management has a directory traversal vulnerability due to insufficient path validation. This allows an attacker with low privileges to read files from directories they don’t have access to, resulting in a high impact on confidentiality. Integrity and availability are not affected. CVSS v3 Base Score 7,7/ 10 [CVE-2025-30014]

8. Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) (3581811):Due to a directory traversal vulnerability, an authorized attacker could gain access to critical information by using an RFC-enabled function module. If successfully exploited, the attacker could read files from any managed system connected to SAP Solution Manager, resulting in a high impact on confidentiality. There is no impact on integrity or availability. CVSS v3 Base Score 7,7/ 10 [CVE-2025-27428]

Enlaces de referencia

Referencias, en inglés de SAP y Onapsis (abril):

SAP Security Patch Day – April 2025

SAP Patch Day: April 2025 – Onapsis

Recursos afectados

El listado completo de los sistemas/componentes afectados es el siguiente