CVE-2025-42924

{
  "id": "CVE-2025-42924",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-11T01:15:39.100",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page controlled by the attacker. This has low impact on confidentiality and integrity of the application with no impact on availability."
    },
    {
      "lang": "es",
      "value": "El BSP de SAP E-Recruiting del entorno SAP S/4HANA permite a un atacante no autenticado crear enlaces maliciosos; al hacer clic, la víctima podría ser redirigida a la página controlada por el atacante. Esto tiene bajo impacto en la confidencialidad e integridad de la aplicación, sin impacto en la disponibilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP S/4HANA landscape (SAP E-Recruiting BSP)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "S4ERECRT 100",
              "status": "affected"
            },
            {
              "version": "200",
              "status": "affected"
            },
            {
              "version": "ERECRUIT 600",
              "status": "affected"
            },
            {
              "version": "603",
              "status": "affected"
            },
            {
              "version": "604",
              "status": "affected"
            },
            {
              "version": "605",
              "status": "affected"
            },
            {
              "version": "606",
              "status": "affected"
            },
            {
              "version": "616",
              "status": "affected"
            },
            {
              "version": "617",
              "status": "affected"
            },
            {
              "version": "800",
              "status": "affected"
            },
            {
              "version": "801",
              "status": "affected"
            },
            {
              "version": "802",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-12T17:30:55.390481Z",
          "id": "CVE-2025-42924",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3642398",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}