CVE-2025-42939
Medium
Description
SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the application without affecting its confidentiality or availability.
SeverityMedium
CVSS4.3
Exploit probability—
ProductSAP S/4HANA (Manage Processing Rules - For Bank Statements)
PublishedOct 14, 2025
First seenOct 14, 2025
Weakness typeCWE-863Incorrect authorization
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SAP_SE SAP S/4HANA (Manage Processing Rules - For Bank Statements) | S4CORE 104, 105, 106, 107, 108, 109 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.