VulnerabilityDeferred

CVE-2025-42992

SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR.

MEDIUM 6.9EPSS 0.12%

Does this matter?

Lower severity and a low EPSS score (0.12%). Track it; it rarely justifies an emergency change on its own.

Description

SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files and directory permissions without breaking signature validation, resulting in potential privilege escalation. This has high impact on integrity, but low impact on confidentiality and availability of the system.

CVSS 3.1: 6.9 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
EPSS: 0.12% probability · 2th percentile
CISA KEV: Not listed
Weakness: CWE-266
Source: cna@sap.com

References

https://me.sap.com/notes/3595143
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.