CVE-2025-25244

Vulnerability

Overview

CVE-2025-25244 describes a missing authorization check in SAP Business Warehouse (Process Chains). An attacker who possesses display authorization for a process chain object can manipulate the execution of that chain by setting one or all processes to be skipped. This flaw stems from insufficient validation of user permissions when modifying process execution states.

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must have valid SAP credentials with at least display authorization for the target process chain object. No special network access is required beyond normal authenticated access to the SAP system. The attacker can then alter the process chain configuration to skip specific steps, such as data loading, activation, or deletion, without needing additional privileges.

Impact

Successful exploitation leads to integrity impact: the intended sequence of activities is not executed as modeled, which can result in unexpected or incomplete business reporting. The CVSS v3 base score is 5.7 (Medium), reflecting significant integrity impact but no impact on confidentiality or availability.

Mitigation

SAP has addressed this issue in its monthly Security Patch Day [1]. Organizations running affected versions of SAP Business Warehouse should apply the corresponding SAP Security Note as soon as possible. No workarounds have been published; patching is the recommended course of action.