PT-2025-28284 · Sap · Sap Cmc Promotion Management

Published 2025-07-07 · Updated 2025-07-24 · CVE-2025-42965

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP CMC Promotion Management (affected versions not specified)

Description: The issue allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analyzing response times for various IP addresses and ports, the attacker can infer valid network endpoints. This may lead to information disclosure, but it does not impact the integrity or availability of the application.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-10653

CVE-2025-42965

Affected Products

Sap Cmc Promotion Management

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-42965 · Security Note
• https://bdu.fstec.ru/vul/2025-10653 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html · Note
• https://twitter.com/CVEnew/status/1942418294964699435 · Twitter Post
• https://me.sap.com/notes/3598118 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/jmdevlabs/status/1948377933153698083 · Twitter Post