SAP_SE Vulnerabilities and Affected Products
Vulnerabilities associated with SAPCAR.
Products
Clear product- SAP BusinessObjects Business Intelligence Platform22 vulnerabilities
- SAP NetWeaver Application Server for ABAP and ABAP Platform16 vulnerabilities
- SAP NetWeaver Application Server ABAP12 vulnerabilities
- SAP NetWeaver Application Server for ABAP12 vulnerabilities
- SAP Business AI Platform (Approuter)11 vulnerabilities
- SAP NetWeaver Application Server ABAP and ABAP Platform10 vulnerabilities
- SAP NetWeaver AS ABAP and ABAP Platform9 vulnerabilities
- SAP Commerce Cloud8 vulnerabilities
- SAP GUI for Windows8 vulnerabilities
- SAP NetWeaver Application Server Java8 vulnerabilities
- SAP Business Connector7 vulnerabilities
- SAP CRM WebClient UI7 vulnerabilities
- SAP Enable Now6 vulnerabilities
- SAP Fiori App (Intercompany Balance Reconciliation)6 vulnerabilities
- SAP NetWeaver Enterprise Portal6 vulnerabilities
- SAP Manufacturing Integration and Intelligence5 vulnerabilities
- SAP Supplier Relationship Management (Live Auction Cockpit)5 vulnerabilities
- SAP Web Dispatcher5 vulnerabilities
- SAP Commerce4 vulnerabilities
- SAP Financial Consolidation4 vulnerabilities
- SAP Host Agent4 vulnerabilities
- SAP NetWeaver4 vulnerabilities
- SAP NetWeaver AS Java4 vulnerabilities
- SAP Solution Manager4 vulnerabilities
- SAPCAR4 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-43001MEDIUM | Multiple Privilege Escalation Vulnerabilities in SAPCARSAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting the archive, leading to privilege escalation. On successful exploitation, an attacker could modify the critical files by tampering with signed archives without breaking the signature, but it has a low impact on the confidentiality and availability of the system. CWE-266Jul 8, 2025 | CVSS6.9v3.1 | EPSS0.139% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-42992MEDIUM | Multiple Privilege Escalation Vulnerabilities in SAPCARSAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files and directory permissions without breaking signature validation, resulting in potential privilege escalation. This has high impact on integrity, but low impact on confidentiality and availability of the system. CWE-266Jul 8, 2025 | CVSS6.9v3.1 | EPSS0.123% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-42971MEDIUM | Memory Corruption vulnerability in SAPCARA memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets processed by SAPCAR on their system, resulting in out-of-bounds memory read and write. This could lead to file extraction and file overwrite outside the intended directories. This vulnerability has low impact on the confidentiality, integrity and availability of the application. CWE-787Jul 8, 2025 | CVSS4.0v3.1 | EPSS0.14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-42970MEDIUM | Directory Traversal vulnerability in SAPCARSAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directory traversal sequences. When a high privileged victim extracts this malicious archive, it is then processed by SAPCAR on their system, causing files to be extracted outside the intended directory and overwriting files in arbitrary locations. This vulnerability has a high impact on the integrity and availability of the application with no i… CWE-22Jul 8, 2025 | CVSS5.8v3.1 | EPSS0.292% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |