Threats Tagged 'cve-2025-42903'

CVE-2025-42903 is a medium severity vulnerability in SAP Financial Service Claims Management affecting multiple versions. It involves an observable response discrepancy in the RFC function ICL_USER_GET_NAME_AND_ADDRESS, which can be exploited for user enumeration and limited disclosure of personal data. The vulnerability impacts confidentiality with no effect on integrity or availability and requires low privileges but no user interaction. There are no known exploits in the wild, and no patches have been published yet. The affected SAP versions include INSURANCE 803 through 806 and S4CEXT 107 through 109. European organizations using these SAP modules, especially in insurance and financial sectors, could face targeted reconnaissance attempts. Mitigation involves restricting access to the vulnerable RFC function, monitoring for unusual query patterns, and applying SAP security best practices. Countries with significant SAP Financial Services deployments and strong insurance sectors, such as Germany, France, and the UK, are most likely to be affected. The vulnerability’s CVSS score is 4.3, reflecting a medium severity due to limited confidentiality impact and ease of exploitation with privileges.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-42903#cwe-204