CVE-2025-43009

Vulnerability

Overview

CVE-2025-43009 in SAP Service Parts Management (SPM) stems from missing authorization checks for authenticated users. The application fails to enforce proper access controls, allowing an attacker with valid credentials to perform actions beyond their intended privilege level [1].

Exploitation

Prerequisites

An attacker must first authenticate to the SAP SPM system. No additional privileges are required beyond basic user access. Once authenticated, the attacker can exploit the absent authorization checks to access or modify resources that should be restricted [1].

Impact

Successful exploitation leads to privilege escalation within the application. The impact on confidentiality, integrity, and availability is rated as low per the CVSS scoring, but the breach of authorization boundaries could enable further unauthorized actions or data exposure [1].

Mitigation

SAP has released a security note addressing this vulnerability as part of its regular Patch Day cycle. Organizations running SPM should apply the relevant patch or support package to remediate the missing authorization checks [1].