CVE-2025-42897: SAP Business One Information Disclosure

CVE-2025-42897 Overview

CVE-2025-42897 is an information disclosure vulnerability affecting the anonymous Application Programming Interface (API) exposed by the System Landscape Directory (SLD) component of SAP Business One. An attacker with normal user access can invoke this anonymous API to retrieve unauthorized information from the application. The flaw is categorized under [CWE-522] Insufficiently Protected Credentials and is exploitable remotely over the network without user interaction. Exploitation impacts confidentiality but does not affect integrity or availability of the affected system.

Critical Impact
Authenticated users with baseline privileges can retrieve sensitive information exposed through the SLD anonymous API, undermining confidentiality of the SAP Business One landscape.

Affected Products

SAP Business One
SAP Business One System Landscape Directory (SLD)
Refer to SAP Note #3652901 for the exact affected versions

Discovery Timeline

2025-11-11 - CVE-2025-42897 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42897

Vulnerability Analysis

The vulnerability resides in an anonymous API endpoint exposed by the SAP Business One System Landscape Directory. The SLD centralizes configuration data about connected systems, service endpoints, and credentials used across a Business One landscape. The affected API path does not enforce sufficient authorization checks before returning data. As a result, any user with baseline network access to the service can query the endpoint and retrieve information intended to be restricted.

The issue is classified as [CWE-522] Insufficiently Protected Credentials, indicating that credential-adjacent data or configuration information can be obtained without the access controls that would normally protect it. The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation at 0.207%.

Root Cause

The root cause is missing authorization enforcement on an anonymous API surface within the SLD. The service treats requests to the endpoint as public even though the data it returns should require authenticated, role-scoped access. Without a server-side check that validates the caller's privileges against the requested resource, sensitive landscape information leaks to any reachable client.

Attack Vector

An attacker sends HTTP requests to the exposed SLD anonymous API over the network. No user interaction is required, and normal user access is sufficient to receive the responses. The attacker parses the responses to extract configuration or credential-adjacent metadata that can support follow-on reconnaissance or lateral movement within the SAP environment. No publicly available proof-of-concept exploit or in-the-wild exploitation has been reported for this CVE.

Technical details are described in prose only. Refer to SAP Note #3652901 for vendor-specific implementation details.

Detection Methods for CVE-2025-42897

Indicators of Compromise

Unexpected HTTP requests to SAP Business One SLD anonymous API endpoints from non-administrative user contexts or unfamiliar source IP addresses.
Response payloads from the SLD containing landscape configuration or credential metadata delivered to unauthenticated or low-privileged sessions.
Repeated enumeration-style requests against SLD API paths originating from a single client within a short time window.

Detection Strategies

Enable verbose access logging on the SAP Business One SLD service and forward logs to a centralized analytics platform for correlation.
Baseline normal API usage patterns and alert on deviations such as anonymous callers reaching endpoints that historically returned only administrative data.
Correlate SLD access events with authentication events to identify low-privileged users retrieving data that exceeds their role scope.

Monitoring Recommendations

Monitor perimeter and internal network telemetry for HTTP requests to SLD service ports from unexpected zones.
Track user-agent strings, request rates, and response sizes on SLD endpoints to surface scripted enumeration activity.
Review SAP audit logs for the presence of anonymous or low-privileged reads against SLD configuration objects.

How to Mitigate CVE-2025-42897

Immediate Actions Required

Apply the patch referenced in SAP Note #3652901 to all affected SAP Business One SLD installations.
Restrict network access to the SLD service so that only trusted administrative networks can reach the affected API endpoints.
Review SAP Business One user accounts and remove unnecessary standing access to reduce the pool of accounts able to invoke the API.

Patch Information

SAP addresses CVE-2025-42897 in the SAP Security Patch Day release referenced by SAP Note #3652901. Administrators should consult the SAP Security Patch Day portal for the fixed version and any supporting kernel or component prerequisites. Apply the patch in non-production environments first and validate SLD-dependent integrations before rolling forward to production.

Workarounds

Place the SLD behind a reverse proxy or web application firewall that enforces authentication and authorization for all API paths until the patch is deployed.
Segment the SAP Business One landscape network so that only authorized management hosts can communicate with the SLD service.
Rotate any credentials or secrets that may have been referenced in SLD configuration data if exposure is suspected.

bash

# Example: restrict SLD API access to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 40000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 40000 -j DROP