CVE-2025-25244

Summary

SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting leading to a significant impact on integrity. However, there is no impact on confidentiality or availability.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP Business Warehouse (Process Chains)DW4CORE 100affected
SAP_SESAP Business Warehouse (Process Chains)200affected
SAP_SESAP Business Warehouse (Process Chains)300affected
SAP_SESAP Business Warehouse (Process Chains)400affected
SAP_SESAP Business Warehouse (Process Chains)914affected
SAP_SESAP Business Warehouse (Process Chains)SAP_BW 730affected
SAP_SESAP Business Warehouse (Process Chains)731affected
SAP_SESAP Business Warehouse (Process Chains)740affected
SAP_SESAP Business Warehouse (Process Chains)750affected
SAP_SESAP Business Warehouse (Process Chains)751affected
SAP_SESAP Business Warehouse (Process Chains)752affected
SAP_SESAP Business Warehouse (Process Chains)753affected
SAP_SESAP Business Warehouse (Process Chains)754affected
SAP_SESAP Business Warehouse (Process Chains)755affected
SAP_SESAP Business Warehouse (Process Chains)756affected
SAP_SESAP Business Warehouse (Process Chains)757affected
SAP_SESAP Business Warehouse (Process Chains)758affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References