{"id":"CVE-2025-42998","aliases":["EUVD-2025-17592","GHSA-gw6j-cw44-6794"],"status":"published","title":"Security misconfiguration vulnerability in SAP Business One Integration Framework","description":"The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.002,"percentile":0.09987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-346"],"published":"2025-06-10T00:14:11Z","modified":"2026-06-17T09:23:21Z","products":[{"vendor":"sap_se","product":"sap business one integration framework"}],"references":[{"url":"https://me.sap.com/notes/3594258"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-42998"},{"url":"https://github.com/advisories/GHSA-gw6j-cw44-6794"}],"sources":{"cve":[{"id":"CVE-2025-42998","title":"Security misconfiguration vulnerability in SAP Business One Integration Framework","description":"The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.","status":"published","published":"2025-06-10T00:14:11.037Z","modified":"2025-06-10T15:14:57.46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:32:30.9782Z"}],"euvd":[{"id":"EUVD-2025-17592","description":"The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.","status":"published","published":"2025-06-10T00:14:11Z","modified":"2025-06-10T15:14:57Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:26.841647Z"}],"ghsa":[{"id":"GHSA-gw6j-cw44-6794","title":"The security settings in the SAP Business One Integration Framework are not adequately checked,...","description":"The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.","status":"published","published":"2025-06-10T03:30:29Z","modified":"2025-06-10T03:30:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:02:38.912983Z"}],"nvd":[{"id":"CVE-2025-42998","description":"The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.","status":"published","published":"2025-06-10T01:15:23.307Z","modified":"2026-06-17T09:23:21.897Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:11:11.4244Z"}]}}