Vulnerability-Lookup

CVE-2025-42889 (GCVE-0-2025-42889)

Vulnerability from cvelistv5 – Published: 2025-11-11 00:15 – Updated: 2025-11-12 20:11

Title

SQL Injection vulnerability in SAP Starter Solution (PL SAFT)

Summary

SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application's confidentiality and integrity but no impact on its availability.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-12 17:32 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command

Assigner

sap CNA under the mitre root

CNA scorecard C 65/100 over 117 records in the last 180 days details

References

2 references

URL	Tags
https://me.sap.com/notes/2886616
https://url.sap/sapsecuritypatchday

Impacted products

1 product

Vendor	Product	Version	CPE status
SAP_SE	SAP Starter Solution (PL SAFT)	Affected: SAP_APPL 600 Affected: 602 Affected: 603 Affected: 604 Affected: 605 Affected: 606 Affected: 616 Affected: SAP_FIN 617 Affected: 618 Affected: 700 Affected: 720 Affected: 730 Affected: S4CORE 100 Affected: 101 Affected: 102 Affected: 103 Affected: 104	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42889",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-12T17:32:06.774845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-12T20:11:06.168Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Starter Solution (PL SAFT)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_APPL 600"
            },
            {
              "status": "affected",
              "version": "602"
            },
            {
              "status": "affected",
              "version": "603"
            },
            {
              "status": "affected",
              "version": "604"
            },
            {
              "status": "affected",
              "version": "605"
            },
            {
              "status": "affected",
              "version": "606"
            },
            {
              "status": "affected",
              "version": "616"
            },
            {
              "status": "affected",
              "version": "SAP_FIN 617"
            },
            {
              "status": "affected",
              "version": "618"
            },
            {
              "status": "affected",
              "version": "700"
            },
            {
              "status": "affected",
              "version": "720"
            },
            {
              "status": "affected",
              "version": "730"
            },
            {
              "status": "affected",
              "version": "S4CORE 100"
            },
            {
              "status": "affected",
              "version": "101"
            },
            {
              "status": "affected",
              "version": "102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application\u0027s confidentiality and integrity but no impact on its availability.\u003c/p\u003e"
            }
          ],
          "value": "SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application\u0027s confidentiality and integrity but no impact on its availability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-11T00:15:14.933Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/2886616"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SQL Injection vulnerability in SAP Starter Solution (PL SAFT)",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2025-42889",
    "datePublished": "2025-11-11T00:15:14.933Z",
    "dateReserved": "2025-04-16T13:25:19.826Z",
    "dateUpdated": "2025-11-12T20:11:06.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-42889",
      "date": "2026-10-22",
      "epss": "0.00199",
      "percentile": "0.09177"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP Starter Solution (PL SAFT)",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "SAP_APPL 600"
                  },
                  {
                    "status": "affected",
                    "version": "602"
                  },
                  {
                    "status": "affected",
                    "version": "603"
                  },
                  {
                    "status": "affected",
                    "version": "604"
                  },
                  {
                    "status": "affected",
                    "version": "605"
                  },
                  {
                    "status": "affected",
                    "version": "606"
                  },
                  {
                    "status": "affected",
                    "version": "616"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_FIN 617"
                  },
                  {
                    "status": "affected",
                    "version": "618"
                  },
                  {
                    "status": "affected",
                    "version": "700"
                  },
                  {
                    "status": "affected",
                    "version": "720"
                  },
                  {
                    "status": "affected",
                    "version": "730"
                  },
                  {
                    "status": "affected",
                    "version": "S4CORE 100"
                  },
                  {
                    "status": "affected",
                    "version": "101"
                  },
                  {
                    "status": "affected",
                    "version": "102"
                  },
                  {
                    "status": "affected",
                    "version": "103"
                  },
                  {
                    "status": "affected",
                    "version": "104"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application\u0027s confidentiality and integrity but no impact on its availability."
          },
          {
            "lang": "es",
            "value": "SAP Starter Solution permite a un atacante autenticado ejecutar consultas de base de datos manipuladas, exponiendo as\u00ed la base de datos back-end. Como resultado, esta vulnerabilidad tiene un impacto bajo en la confidencialidad e integridad de la aplicaci\u00f3n, pero ning\u00fan impacto en su disponibilidad."
          }
        ],
        "id": "CVE-2025-42889",
        "lastModified": "2026-10-18T21:10:00.120",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.5,
              "source": "cna@sap.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-42889",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-12T17:32:06.774845Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-11-11T01:15:37.663",
        "references": [
          {
            "source": "cna@sap.com",
            "url": "https://me.sap.com/notes/2886616"
          },
          {
            "source": "cna@sap.com",
            "url": "https://url.sap/sapsecuritypatchday"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-89"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-12T00:36:09+00:00",
      "cve": "CVE-2025-42889",
      "id": "CVE-2025-42889",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "SQL Injection vulnerability in SAP Starter Solution (PL SAFT)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-42889.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-42889",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-11-12T17:32:06.774845Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-11-12T17:32:09.715Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAP Starter Solution (PL SAFT)",
              "vendor": "SAP_SE",
              "versions": [
                {
                  "status": "affected",
                  "version": "SAP_APPL 600"
                },
                {
                  "status": "affected",
                  "version": "602"
                },
                {
                  "status": "affected",
                  "version": "603"
                },
                {
                  "status": "affected",
                  "version": "604"
                },
                {
                  "status": "affected",
                  "version": "605"
                },
                {
                  "status": "affected",
                  "version": "606"
                },
                {
                  "status": "affected",
                  "version": "616"
                },
                {
                  "status": "affected",
                  "version": "SAP_FIN 617"
                },
                {
                  "status": "affected",
                  "version": "618"
                },
                {
                  "status": "affected",
                  "version": "700"
                },
                {
                  "status": "affected",
                  "version": "720"
                },
                {
                  "status": "affected",
                  "version": "730"
                },
                {
                  "status": "affected",
                  "version": "S4CORE 100"
                },
                {
                  "status": "affected",
                  "version": "101"
                },
                {
                  "status": "affected",
                  "version": "102"
                },
                {
                  "status": "affected",
                  "version": "103"
                },
                {
                  "status": "affected",
                  "version": "104"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eSAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application\u0027s confidentiality and integrity but no impact on its availability.\u003c/p\u003e"
                }
              ],
              "value": "SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application\u0027s confidentiality and integrity but no impact on its availability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-89",
                  "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
                  "lang": "eng",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-11-11T00:15:14.933Z",
            "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            "shortName": "sap"
          },
          "references": [
            {
              "url": "https://me.sap.com/notes/2886616"
            },
            {
              "url": "https://url.sap/sapsecuritypatchday"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "SQL Injection vulnerability in SAP Starter Solution (PL SAFT)",
          "x_generator": {
            "engine": "Vulnogram 0.5.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "assignerShortName": "sap",
        "cveId": "CVE-2025-42889",
        "datePublished": "2025-11-11T00:15:14.933Z",
        "dateReserved": "2025-04-16T13:25:19.826Z",
        "dateUpdated": "2025-11-12T20:11:06.168Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2025-14481 (CVE-2025-42889)

Vulnerability from fstec – Published: 2025-11-20 – Updated: 2025-11-20 – View on bdu.fstec.ru Fixed

Title

Уязвимость средства управления налогами и бухгалтерией для малых и средних предприятий SAP Starter Solution (PL SAFT), связанная с непринятием мер по защите структуры запроса SQL, позволяющая нарушителю выполнить произвольные SQL-запросы к базе данных

Summary

Уязвимость средства управления налогами и бухгалтерией для малых и средних предприятий SAP Starter Solution (PL SAFT) связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольные SQL-запросы к базе данных

Severity

5.5 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:S/C:P/I:P/A:N

5.4 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Being clarified

Remediation

Software update

CWE

CWE-89 - Непринятие мер по защите структуры запроса SQL (атаки типа \"внедрение SQL\")

Aliases

CVE-2025-42889

References

1 reference

URL
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/novemb…

Impacted products

1 product from 1 vendor

Vendors

SAP

Products

SAP Starter Solution (PL SAFT)

Versions

SAP_APPL 600 (SAP Starter Solution (PL SAFT)), SAP_APPL 602 (SAP Starter Solution (PL SAFT)), SAP_APPL 603 (SAP Starter Solution (PL SAFT)), SAP_APPL 604 (SAP Starter Solution (PL SAFT)), SAP_APPL 605 (SAP Starter Solution (PL SAFT)), SAP_APPL 606 (SAP Starter Solution (PL SAFT)), SAP_APPL 616 (SAP Starter Solution (PL SAFT)), SAP_FIN 617 (SAP Starter Solution (PL SAFT)), SAP_FIN 618 (SAP Starter Solution (PL SAFT)), SAP_FIN 720 (SAP Starter Solution (PL SAFT)), SAP_FIN 700 (SAP Starter Solution (PL SAFT)), SAP_FIN 730 (SAP Starter Solution (PL SAFT)), S4CORE 100 (SAP Starter Solution (PL SAFT)), S4CORE 101 (SAP Starter Solution (PL SAFT)), S4CORE 102 (SAP Starter Solution (PL SAFT)), S4CORE 103 (SAP Starter Solution (PL SAFT)), S4CORE 104 (SAP Starter Solution (PL SAFT))

Product types

Application software

Mitigations

Использование рекомендаций: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "SAP",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "SAP_APPL 600 (SAP Starter Solution (PL SAFT)), SAP_APPL 602 (SAP Starter Solution (PL SAFT)), SAP_APPL 603 (SAP Starter Solution (PL SAFT)), SAP_APPL 604 (SAP Starter Solution (PL SAFT)), SAP_APPL 605 (SAP Starter Solution (PL SAFT)), SAP_APPL 606 (SAP Starter Solution (PL SAFT)), SAP_APPL 616 (SAP Starter Solution (PL SAFT)), SAP_FIN 617 (SAP Starter Solution (PL SAFT)), SAP_FIN 618 (SAP Starter Solution (PL SAFT)), SAP_FIN 720 (SAP Starter Solution (PL SAFT)), SAP_FIN 700 (SAP Starter Solution (PL SAFT)), SAP_FIN 730 (SAP Starter Solution (PL SAFT)), S4CORE 100 (SAP Starter Solution (PL SAFT)), S4CORE 101 (SAP Starter Solution (PL SAFT)), S4CORE 102 (SAP Starter Solution (PL SAFT)), S4CORE 103 (SAP Starter Solution (PL SAFT)), S4CORE 104 (SAP Starter Solution (PL SAFT))",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "11.11.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "20.11.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "20.11.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-14481",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-42889",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SAP Starter Solution (PL SAFT)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u043b\u043e\u0433\u0430\u043c\u0438 \u0438 \u0431\u0443\u0445\u0433\u0430\u043b\u0442\u0435\u0440\u0438\u0435\u0439 \u0434\u043b\u044f \u043c\u0430\u043b\u044b\u0445 \u0438 \u0441\u0440\u0435\u0434\u043d\u0438\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439 SAP Starter Solution (PL SAFT), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u0430 SQL, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435 \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u0430 SQL (\u0430\u0442\u0430\u043a\u0438 \u0442\u0438\u043f\u0430 \\\"\u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435  SQL\\\") (CWE-89)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u043b\u043e\u0433\u0430\u043c\u0438 \u0438 \u0431\u0443\u0445\u0433\u0430\u043b\u0442\u0435\u0440\u0438\u0435\u0439 \u0434\u043b\u044f \u043c\u0430\u043b\u044b\u0445 \u0438 \u0441\u0440\u0435\u0434\u043d\u0438\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439 SAP Starter Solution (PL SAFT) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u0430 SQL. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-89",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,4)"
}

CERTFR-2025-AVI-0982

Vulnerability from certfr_avis - Published: 2025-11-12 - Updated: 2025-11-12

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection SQL (SQLi).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SAP	N/A	S4CORE (Manage Journal Entries) versions S4CORE 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité
SAP	N/A	CommonCryptoLib CRYPTOLIB 8 sans le dernier correctif de sécurité
SAP	N/A	SQL Anywhere Monitor (Non-Gui) version SYBASE_SQL_ANYWHERE_SERVER 17.0 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Enterprise Portal versions EP-BASIS 7.50 et EP-RUNTIME 7.50 sans le dernier correctif de sécurité
SAP	N/A	Business Connector version SAP BC 4.8 sans le dernier correctif de sécurité
SAP	N/A	HANA JDBC Client version HDB_CLIENT 2.0 sans le dernier correctif de sécurité
SAP	N/A	GUI for Windows versions BC-FES-GUI 8.00 et 8.10 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server for ABAP (Migration Workbench) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité
SAP	N/A	Solution Manager version ST 720 sans le dernier correctif de sécurité
SAP	N/A	HANA 2.0 (hdbrss) version HDB 2.00 sans le dernier correctif de sécurité
SAP	N/A	Starter Solution (PL SAFT) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, SAP_FIN 617, 618, 700, 720, 730, S4CORE 100, 101, 102, 103 et 104 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server Java versions ENGINEAPI 7.50 et EP-BASIS 7.50 sans le dernier correctif de sécurité
SAP	N/A	Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS Java version SERVERCORE 7.50 sans le dernier correctif de sécurité
SAP	N/A	Business One (SLD) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de sécurité
SAP	N/A	S/4HANA landscape (E-Recruiting BSP) versions S4ERECRT 100, 200, ERECRUIT 600, 603, 604, 605, 606, 616, 617, 800, 801 et 802 sans le dernier correctif de sécurité

References

Title

Publication Time

FKIE_CVE-2025-42889

Vulnerability from fkie_nvd - Published: 2025-11-11 01:15 - Updated: 2026-10-18 21:10

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	cna@sap.com	https://me.sap.com/notes/2886616
	cna@sap.com	https://url.sap/sapsecuritypatchday

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Starter Solution (PL SAFT)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_APPL 600"
            },
            {
              "status": "affected",
              "version": "602"
            },
            {
              "status": "affected",
              "version": "603"
            },
            {
              "status": "affected",
              "version": "604"
            },
            {
              "status": "affected",
              "version": "605"
            },
            {
              "status": "affected",
              "version": "606"
            },
            {
              "status": "affected",
              "version": "616"
            },
            {
              "status": "affected",
              "version": "SAP_FIN 617"
            },
            {
              "status": "affected",
              "version": "618"
            },
            {
              "status": "affected",
              "version": "700"
            },
            {
              "status": "affected",
              "version": "720"
            },
            {
              "status": "affected",
              "version": "730"
            },
            {
              "status": "affected",
              "version": "S4CORE 100"
            },
            {
              "status": "affected",
              "version": "101"
            },
            {
              "status": "affected",
              "version": "102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application\u0027s confidentiality and integrity but no impact on its availability."
    },
    {
      "lang": "es",
      "value": "SAP Starter Solution permite a un atacante autenticado ejecutar consultas de base de datos manipuladas, exponiendo as\u00ed la base de datos back-end. Como resultado, esta vulnerabilidad tiene un impacto bajo en la confidencialidad e integridad de la aplicaci\u00f3n, pero ning\u00fan impacto en su disponibilidad."
    }
  ],
  "id": "CVE-2025-42889",
  "lastModified": "2026-10-18T21:10:00.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-42889",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-12T17:32:06.774845Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-11T01:15:37.663",
  "references": [
    {
      "source": "cna@sap.com",
      "url": "https://me.sap.com/notes/2886616"
    },
    {
      "source": "cna@sap.com",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-WVJ2-MCCW-PG3M

Vulnerability from github – Published: 2025-11-11 03:30 – Updated: 2025-11-11 03:30

Details

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-42889"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-11T01:15:37Z",
    "severity": "MODERATE"
  },
  "details": "SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application\u0027s confidentiality and integrity but no impact on its availability.",
  "id": "GHSA-wvj2-mccw-pg3m",
  "modified": "2025-11-11T03:30:28Z",
  "published": "2025-11-11T03:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42889"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/2886616"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2025-0356

Vulnerability from csaf_ncscnl - Published: 2025-11-11 12:15 - Updated: 2025-11-11 12:15

Summary

Kwetsbaarheden verholpen in SAP-producten

Scope

19 vulnerabilities in this advisory, including CVE-2025-42889.

CVE-2025-42889

The SAP Starter Solution contains a SQL Injection vulnerability that allows authenticated attackers to execute crafted database queries, posing a low risk to confidentiality and integrity.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Known affected: 12 products

Open the full advisory

WID-SEC-W-2025-2536

Vulnerability from csaf_certbund - Published: 2025-11-10 23:00 - Updated: 2025-11-12 23:00

Summary

SAP Software: Mehrere Schwachstellen

Severity

Hoch

Scope

19 vulnerabilities in this advisory, including CVE-2025-42889.

CVE-2025-42889

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-42889 (GCVE-0-2025-42889)

BDU:2025-14481 (CVE-2025-42889)

CERTFR-2025-AVI-0982

Solutions

FKIE_CVE-2025-42889

GHSA-WVJ2-MCCW-PG3M

NCSC-2025-0356

WID-SEC-W-2025-2536

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour