CVE-2025-42923: SAP Fiori App (F4044 Manage Work Center Groups) · Cross-Site Request Forgery (CSRF)
Affects SAP Fiori App (F4044 Manage Work Center Groups)Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SAP_SE SAP Fiori App (F4044 Manage Work Center Groups) | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-42923, European organizations should implement the following specific measures: 1) Apply SAP security patches promptly once released for the affected SAP Fiori app versions to ensure proper CSRF protections are enforced. 2) Enforce strict session management and implement additional CSRF tokens or double-submit cookie patterns in custom SAP Fiori app extensions or configurations. 3) Conduct user awareness training to reduce the risk of users being tricked into executing malicious requests, emphasizing cautious behavior with unsolicited links or embedded content. 4) Restrict SAP Fiori app access to trusted networks and use network segmentation to limit exposure of the SAP web interface. 5) Monitor SAP application logs for unusual or unauthorized changes to work center groups and implement anomaly detection to identify potential CSRF exploitation attempts. 6) Review and tighten user privileges to follow the principle of least privilege, minimizing the number of users with rights to modify work center groups. 7) Employ web application firewalls (WAFs) with rules tuned to detect and block CSRF attack patterns targeting SAP Fiori endpoints. These targeted mitigations go beyond generic advice by focusing on SAP-specific controls, user behavior, and network-level protections.
Description
Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server. This has low impact on integrity and no impact on confidentiality and availability of the application.