PT-2025-6125 · Sap · Sap Erp+1

Published 2025-02-11 · Updated 2025-02-11 · CVE-2025-23191

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SAP ERP (affected versions not specified)

Description: The issue concerns the SAP OData endpoint in SAP Fiori for SAP ERP, where cached values could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the atom:link values in the returned metadata, redirecting them from the SAP server to a malicious link. This could cause low impact on the integrity of the application.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-644

Related Identifiers

BDU:2025-02755

CVE-2025-23191

Affected Products

Sap Erp

Sap Fiori

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-23191 · Security Note
• https://bdu.fstec.ru/vul/2025-02755 · Security Note
• https://twitter.com/CVEnew/status/1889116928104374584 · Twitter Post
• https://t.me/cvedetector/17626 · Telegram Post
• https://me.sap.com/notes/3426825 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2025.html · Note