CVE-2025-42910
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-14

Assigner: SAP SE

Description
Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-14
Last Modified
2025-10-14
Generated
2026-06-16
AI Q&A
2025-10-14
EPSS Evaluated
2026-06-15
NVD
CVE-2025-42910
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sap supplier_relationship_management 3.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files because the system does not verify the file type or content. These files could be executables that might be downloaded and run by users, potentially hosting malware.

Impact Analysis

Exploitation of this vulnerability can lead to a high impact on the confidentiality, integrity, and availability of the application. An attacker could execute malicious files, potentially compromising the system and its data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-42910. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart