PT-2025-28301 · Sap · Sapcar

Published 2025-07-08 · Updated 2025-07-08 · CVE-2025-43001

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions: SAPCAR (affected versions not specified)

Description: The issue allows an attacker with high privileges to override the permissions of the current and parent directories of the user or process extracting the archive, leading to privilege escalation. On successful exploitation, an attacker could modify critical files by tampering with signed archives without breaking the signature. However, it has a low impact on the confidentiality and availability of the system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2025-16216

CVE-2025-43001

Affected Products

Sapcar

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-43001 · Security Note
• https://bdu.fstec.ru/vul/2025-16216 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html · Note
• https://me.sap.com/notes/3595143 · Note
• https://twitter.com/CVEnew/status/1942418280578158894 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/gothburz/status/1942637640626418129 · Twitter Post