CVE-2025-42892
BaseFortify
Publication date: 2025-11-11
Last updated on: 2025-11-12
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | business_connector | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an OS Command Injection in SAP Business Connector. An authenticated attacker with administrative and adjacent network access can upload specially crafted content to the server. When the application processes this content, it allows the attacker to execute arbitrary operating system commands.
How can this vulnerability impact me? :
Exploitation of this vulnerability could lead to full compromise of the system's confidentiality, integrity, and availability, meaning an attacker could gain control over sensitive data, alter or destroy information, and disrupt system operations.