Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal (SAP_SE SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.36 % · percentile 30 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Deferred
Description
Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. There is no impact on integrity and availability.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.8 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N | sap |
| CVSS 3.1 | MEDIUM 5.8 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-14341
- GCVE · GCVE-0-2025-43008
CERT-FR advisories
- CERTFR-2025-AVI-0396 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal | affected S4HCMCPT 100 ; affected 101 ; affected SAP_HRCPT 600 ; affected 604 ; affected 608 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |