CVE-2025-42929

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-42929", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-04-16T13:25:32.385Z", "datePublished": "2025-09-09T02:10:59.447Z", "dateUpdated": "2025-09-09T13:56:41.986Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Landscape Transformation Replication Server", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "DMIS 2011_1_620"}, {"status": "affected", "version": "2011_1_640"}, {"status": "affected", "version": "2011_1_700"}, {"status": "affected", "version": "2011_1_710"}, {"status": "affected", "version": "2011_1_730"}, {"status": "affected", "version": "2011_1_731"}, {"status": "affected", "version": "2011_1_752"}, {"status": "affected", "version": "2020"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database.</p>"}], "value": "Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1287", "description": "CWE-1287: Improper Validation of Specified Type of Input", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2025-09-09T02:10:59.447Z"}, "references": [{"url": "https://me.sap.com/notes/3633002"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Missing input validation vulnerability in SAP Landscape Transformation Replication Server", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-09T13:56:24.949485Z", "id": "CVE-2025-42929", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-09T13:56:41.986Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-42929", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-09T13:56:24.949485Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-09T13:56:34.617Z"}}], "cna": {"title": "Missing input validation vulnerability in SAP Landscape Transformation Replication Server", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Landscape Transformation Replication Server", "versions": [{"status": "affected", "version": "DMIS 2011_1_620"}, {"status": "affected", "version": "2011_1_640"}, {"status": "affected", "version": "2011_1_700"}, {"status": "affected", "version": "2011_1_710"}, {"status": "affected", "version": "2011_1_730"}, {"status": "affected", "version": "2011_1_731"}, {"status": "affected", "version": "2011_1_752"}, {"status": "affected", "version": "2020"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3633002"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-1287", "description": "CWE-1287: Improper Validation of Specified Type of Input"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2025-09-09T02:10:59.447Z"}}}, "cveMetadata": {"cveId": "CVE-2025-42929", "state": "PUBLISHED", "dateUpdated": "2025-09-09T13:56:41.986Z", "dateReserved": "2025-04-16T13:25:32.385Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2025-09-09T02:10:59.447Z", "assignerShortName": "sap"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Landscape Transformation Replication Server", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "DMIS 2011_1_620"}, {"status": "affected", "version": "2011_1_640"}, {"status": "affected", "version": "2011_1_700"}, {"status": "affected", "version": "2011_1_710"}, {"status": "affected", "version": "2011_1_730"}, {"status": "affected", "version": "2011_1_731"}, {"status": "affected", "version": "2011_1_752"}, {"status": "affected", "version": "2020"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database."}], "id": "CVE-2025-42929", "lastModified": "2026-06-17T09:23:15.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 5.8, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-42929", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-09T13:56:24.949485Z", "version": "2.0.3"}}]}, "published": "2025-09-09T02:15:41.420", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3633002"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1287"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"created": "2025-09-09T21:31:48.932088+00:00", "updated": "2025-09-09T21:31:48.932173+00:00", "vendors": ["sap", "sap$PRODUCT$landscape_transformation_replication_server"]}