PT-2025-24589 · Sap · Sap Manage Processing Rules

Published 2025-06-10 · Updated 2025-06-10 · CVE-2025-42987

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Manage Processing Rules (For Bank Statement) (affected versions not specified)

Description The issue allows an attacker with basic privileges to edit shared rules of any user by tampering with the request parameter. This is due to a missing authorization check, which enables the attacker to edit rules that should be restricted, compromising the integrity of the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-10423

CVE-2025-42987

Affected Products

Sap Manage Processing Rules

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-42987 · Security Note
• https://bdu.fstec.ru/vul/2025-10423 · Security Note
• https://twitter.com/VulmonFeeds/status/1932379774699090417 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html · Note
• https://me.sap.com/notes/3596850 · Note
• https://t.me/cvetracker/25846 · Telegram Post
• https://url.sap/sapsecuritypatchday · Note