Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management)

6.9 / 10

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Description

Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacker to potentially read or delete these files hence causing a high impact on confidentiality and low impact on integrity. There is no impact on availability of the system.

Basic Information

ID CVE-2025-42946

Source sap

Published Aug 12, 2025 at 02:07

Affected Product

Vendor SAP_SE

Product SAP S/4HANA (Bank Communication Management)

Version SAP_APPL 606

Affected Versions SAP_SE SAP S/4HANA (Bank Communication Management) SAP_APPL 606
SAP_SE SAP S/4HANA (Bank Communication Management) SAP_FIN 617
SAP_SE SAP S/4HANA (Bank Communication Management) 618
SAP_SE SAP S/4HANA (Bank Communication Management) 720
SAP_SE SAP S/4HANA (Bank Communication Management) 730
SAP_SE SAP S/4HANA (Bank Communication Management) S4CORE 102
SAP_SE SAP S/4HANA (Bank Communication Management) 103
SAP_SE SAP S/4HANA (Bank Communication Management) 104
SAP_SE SAP S/4HANA (Bank Communication Management) 105
SAP_SE SAP S/4HANA (Bank Communication Management) 106
SAP_SE SAP S/4HANA (Bank Communication Management) 107
SAP_SE SAP S/4HANA (Bank Communication Management) 108

CWE Classification

CWE-22

References

{
    "lastseen": "",
    "description": "Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacker to potentially read or delete these files hence causing a high impact on confidentiality and low impact on integrity. There is no impact on availability of the system.",
    "published": "2025-08-12T02:07:16.389Z",
    "modified": "2025-08-12T02:07:16.389Z",
    "type": "cve",
    "title": "Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management)",
    "source": "sap",
    "references": "https://me.sap.com/notes/3614804\nhttps://url.sap/sapsecuritypatchday",
    "id": "CVE-2025-42946",
    "bulletinFamily": "",
    "cwe": [
        "CWE-22"
    ],
    "cvelist": null,
    "sourceData": "SAP_SE SAP S/4HANA (Bank Communication Management) SAP_APPL 606\nSAP_SE SAP S/4HANA (Bank Communication Management) SAP_FIN 617\nSAP_SE SAP S/4HANA (Bank Communication Management) 618\nSAP_SE SAP S/4HANA (Bank Communication Management) 720\nSAP_SE SAP S/4HANA (Bank Communication Management) 730\nSAP_SE SAP S/4HANA (Bank Communication Management) S4CORE 102\nSAP_SE SAP S/4HANA (Bank Communication Management) 103\nSAP_SE SAP S/4HANA (Bank Communication Management) 104\nSAP_SE SAP S/4HANA (Bank Communication Management) 105\nSAP_SE SAP S/4HANA (Bank Communication Management) 106\nSAP_SE SAP S/4HANA (Bank Communication Management) 107\nSAP_SE SAP S/4HANA (Bank Communication Management) 108",
    "sourceHref": "",
    "cvss": {
        "score": 6.9,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "SAP S/4HANA (Bank Communication Management)",
    "version": "SAP_APPL 606",
    "vendor": "SAP_SE",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}

Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management)_CVE-2025-42946