PT-2025-15367 · Sap · Sap Solution Manager

Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-27428

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP Solution Manager (affected versions not specified)

Description: The issue is related to a directory traversal vulnerability. An authorized attacker could access critical information by using an RFC enabled function module. If successfully exploited, this could allow the attacker to read files from any managed system connected to SAP Solution Manager, severely impacting confidentiality. There is no observed impact on integrity or availability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-04841

CVE-2025-27428

Affected Products

Sap Solution Manager

References · 9

• https://bdu.fstec.ru/vul/2025-04841 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27428 · Security Note
• https://twitter.com/cybercronai/status/1909675272602865697 · Twitter Post
• https://twitter.com/vulns_space/status/1909532148744241378 · Twitter Post
• https://me.sap.com/notes/3581811 · Note
• https://t.me/cvetracker/21089 · Telegram Post
• https://t.me/cvedetector/22424 · Telegram Post
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1909528298121838947 · Twitter Post