VulnerabilityDeferred

CVE-2025-42947

SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application.

MEDIUM 5.5EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on confidentiality of the application.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-94
Source: cna@sap.com

References

https://me.sap.com/notes/3540688
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.