CVE-2025-42987

Root Cause

CVE-2025-42987 affects the SAP component Manage Processing Rules (For Bank Statement). The vulnerability is caused by a missing authorization check when processing requests to edit shared rules. An attacker with only basic privileges can tamper with the request parameter to target rules belonging to any user [1].

Exploitation

No special authentication is needed beyond a basic-privilege account. By modifying the request parameter that identifies which user's rules are being edited, the attacker can select rules that should be restricted from their access level. The application does not verify whether the current user is allowed to modify the targeted rules [1].

Impact

Successful exploitation allows the attacker to change shared processing rules for bank statements that belong to another user. This compromises the integrity of the application because the altered rules could cause incorrect or unauthorized processing of bank statement data [1].

Mitigation

SAP has released a security patch as part of its regular Patch Day cycle. Customers are advised to apply the corresponding SAP Security Note without delay. There is no indication of a workaround; updating to the patched version is the only recommended remediation [1].