CVE-2025-42894

{
  "id": "CVE-2025-42894",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-11T01:15:38.307",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system commands on the server, resulting in a complete compromise of the confidentiality, integrity, and availability of the affected system."
    },
    {
      "lang": "es",
      "value": "Debido a una vulnerabilidad de salto de ruta en SAP Business Connector, un atacante autenticado como administrador con acceso adyacente podría leer, escribir, sobrescribir y eliminar archivos arbitrarios en el sistema anfitrión. La explotación exitosa podría permitir al atacante ejecutar comandos arbitrarios del sistema operativo en el servidor, lo que resultaría en un compromiso completo de la confidencialidad, integridad y disponibilidad del sistema afectado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Business Connector",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "SAP BC 4.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-12T04:57:42.410557Z",
          "id": "CVE-2025-42894",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:business_connector:4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "99F0C742-7E03-425D-BCFC-F4683843350F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3666038",
      "source": "[email protected]",
      "tags": [
        "Permissions Required"
      ]
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}