CVE-2025-42998 - Security misconfiguration vulnerability in SAP Business One Integration Framework

Back Back to CVE browser

MEDIUM

Security misconfiguration vulnerability in SAP Business One Integration Framework

Published Jun 10, 2025

5.3

MEDIUM

CVSS 3.1

EPSS 0.19%

Description

The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.

Affected products

Vendor SAP SE Product SAP Business One Integration Framework Default
unaffected
- Version
  B1_ON_HANA 10.0
  Status
  affected
  Constraints
  -
- Version
  SAP-M-BO 10.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Business One Integration Framework

unaffected

Version	Status	Constraints
B1_ON_HANA 10.0	affected	-
SAP-M-BO 10.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-346

References (2)

Link	Providers	Tags
https://me.sap.com/notes/3594258
https://url.sap/sapsecuritypatchday

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Jun 10, 2025

Updated Jun 10, 2025

Reserved Apr 16, 2025

Link CVE-2025-42998

CISA Vulnrichment

Updated Jun 10, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-42998

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-42998