CVE-2025-42903: SAP Claims Management Info Disclosure Flaw

CVE-2025-42903 Overview

CVE-2025-42903 is a user enumeration vulnerability in SAP Financial Services Claims Management. The flaw resides in the Remote Function Call (RFC) function ICL_USER_GET_NAME_AND_ADDRESS. Authenticated attackers can submit crafted requests and observe response discrepancies that reveal valid user identifiers. The function may also disclose personal data tied to enumerated users, aligning with [CWE-204] Observable Response Discrepancy.

The issue carries a low confidentiality impact with no effect on integrity or availability. SAP addressed the issue through its October 2025 Security Patch Day release.

Critical Impact
Authenticated attackers on the network can enumerate valid SAP users and extract associated name and address information through the vulnerable RFC function.

Affected Products

SAP Financial Services Claims Management (RFC function ICL_USER_GET_NAME_AND_ADDRESS)
Refer to SAP Note 3656781 for the complete list of affected support package levels
SAP Security Patch Day advisory covers additional component details

Discovery Timeline

2025-10-14 - CVE CVE-2025-42903 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-42903

Vulnerability Analysis

The vulnerability affects the ICL_USER_GET_NAME_AND_ADDRESS RFC function exposed by SAP Financial Services Claims Management. RFC functions provide programmatic access to SAP backend data over the network and are typically invoked by authenticated clients with low-privilege credentials.

The function responds differently depending on whether a supplied user identifier exists. These observable response discrepancies form the basis of the enumeration flaw. An attacker can iterate through candidate user IDs and classify each one as valid or invalid based on response characteristics.

For valid identifiers, the function returns personal data including names and addresses. This behavior extends the vulnerability from pure enumeration into a direct personal data disclosure channel.

Root Cause

The root cause is improper differentiation of responses for existing versus non-existing users, mapped to [CWE-204] Observable Response Discrepancy. The function does not normalize success and failure paths, allowing attackers to infer backend state. Combined with permissive data exposure in the valid-user response, the issue leaks personally identifiable information (PII) to any caller with RFC access.

Attack Vector

Exploitation requires network access to the SAP system and valid low-privilege credentials. The attacker invokes ICL_USER_GET_NAME_AND_ADDRESS repeatedly with varying user identifiers using any standard RFC client. By comparing response payloads, timing, or error codes, the attacker builds a list of valid users and harvests their stored name and address records. No user interaction is required and the attack can be fully scripted.

See the SAP Note 3656781 for authoritative technical details.

Detection Methods for CVE-2025-42903

Indicators of Compromise

- High-volume RFC calls to ICL_USER_GET_NAME_AND_ADDRESS originating from a single user or host
- Sequential or dictionary-style patterns in user identifier parameters submitted to the function
- Unusual off-hours RFC traffic from low-privileged service accounts to Claims Management components

Detection Strategies

- Enable SAP Security Audit Log (SAL) events for RFC function calls and alert on sustained use of ICL_USER_GET_NAME_AND_ADDRESS
- Correlate RFC gateway logs with user authentication logs to identify brute-force style enumeration patterns
- Baseline normal callers of the function and flag deviations in caller identity, source IP, or request volume

Monitoring Recommendations

- Forward SAP audit and gateway logs into a centralized SIEM or data lake for long-term analysis and correlation
- Monitor RFC traffic for repeated calls with varying input parameters that indicate parameter fuzzing
- Review access to Claims Management RFC-enabled modules by non-business users and dormant accounts

How to Mitigate CVE-2025-42903

Immediate Actions Required

- Apply the SAP patch referenced in SAP Note 3656781 to all affected Financial Services Claims Management systems
- Review authorization assignments granting access to the ICL_USER_GET_NAME_AND_ADDRESS RFC function and remove unneeded entitlements
- Audit RFC gateway access control lists (reginfo and secinfo) to restrict which clients can invoke sensitive functions

Patch Information

SAP released a fix as part of its October 2025 Security Patch Day. Customers must apply the correction documented in SAP Note 3656781 and verify installation against the support package stack of their SAP Financial Services Claims Management deployment. Additional advisories are published on the SAP Security Patch Day portal.

Workarounds

- Restrict RFC access to ICL_USER_GET_NAME_AND_ADDRESS using authorization object S_RFC until the patch is applied
- Enforce network segmentation so only trusted application servers can reach SAP RFC endpoints
- Enable enhanced SAP Security Audit Log coverage on the affected function to detect enumeration attempts during the mitigation window

bash

# Configuration example
# Example SAP transaction references for applying mitigations
# SU24/PFCG : review and restrict S_RFC authorizations for ICL_USER_GET_NAME_AND_ADDRESS
# SMGW      : harden reginfo and secinfo on the RFC gateway
# SM19/RSAU_CONFIG : enable auditing for RFC function calls