What’s Vulnerable › Vulnerabilities

CVE-2025-42998: Security misconfiguration vulnerability in SAP Business One Integration Framework

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-10 · updated 2026-06-17
• Weakness: CWE-346

Description

The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.

Affected products

• SAP_SE SAP Business One Integration Framework: B1_ON_HANA 10.0, SAP-M-BO 10.0

References

• https://me.sap.com/notes/3594258
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42998 or the next vulnerability affects your stack