CVE-2025-42946

Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management)

Severity Score

6.9

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacker to potentially read or delete these files hence causing a high impact on confidentiality and low impact on integrity. There is no impact on availability of the system.

Debido a una vulnerabilidad de directory traversal en SAP S/4HANA (Bank Communication Management), un atacante con privilegios elevados y acceso a una transacción y método específicos de Bank Communication Management podría obtener acceso no autorizado a archivos confidenciales del sistema operativo. Esto podría permitirle leer o eliminar estos archivos, lo que afecta gravemente la confidencialidad y reduce la integridad. La disponibilidad del sistema no se ve afectada.

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Attack Vector

Adjacent

Attack Complexity

Low

Authentication

Multiple

Confidentiality

Complete

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2025-04-16 CVE Reserved
2025-08-12 CVE Published
2025-08-13 CVE Updated
2025-08-18 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (2)

URL	Tag	Source
https://me.sap.com/notes/3614804
https://url.sap/sapsecuritypatchday

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				618 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "618"		en		Affected
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				720 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "720"		en		Affected
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				730 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "730"		en		Affected
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				103 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "103"		en		Affected
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				104 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "104"		en		Affected
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				105 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "105"		en		Affected
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				106 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "106"		en		Affected
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				107 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "107"		en		Affected
SAP SE Search vendor "SAP SE"		SAP S/4HANA (Bank Communication Management) Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)"				108 Search vendor "SAP SE" for product "SAP S/4HANA (Bank Communication Management)" and version "108"		en		Affected