CVE-2025-43000: PMW Information Disclosure Vulnerability

CVE-2025-43000 Overview

CVE-2025-43000 is a missing authorization vulnerability [CWE-862] affecting the SAP Promotion Management Wizard (PMW). Under certain conditions, an authenticated local attacker can access information that would otherwise be restricted by the application's access controls. The flaw primarily impacts confidentiality, with limited effect on integrity and availability. SAP disclosed the issue on its Security Patch Day and released a corrective note for affected customers.

Critical Impact
An authenticated attacker with low privileges can bypass authorization checks in the Promotion Management Wizard to read restricted business data, expanding the blast radius across dependent components.

Affected Products

SAP Promotion Management Wizard (PMW)
SAP business suite deployments integrating PMW
Refer to SAP Note #3586013 for the authoritative list of affected versions

Discovery Timeline

2025-05-13 - CVE-2025-43000 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-43000

Vulnerability Analysis

The vulnerability is a missing authorization check [CWE-862] in the SAP Promotion Management Wizard. PMW processes promotion definitions, pricing conditions, and related merchandising data. When specific request paths are exercised, the application fails to verify that the caller holds the required authorization objects before returning data. This allows a low-privileged authenticated user to retrieve information intended for restricted roles.

Because the CVSS scope is changed, the impact extends beyond the vulnerable component. Data accessed through PMW can influence downstream systems that consume promotion data. The confidentiality impact is rated high, while integrity and availability effects remain limited to the modification of promotion-related records the attacker gains visibility into.

Root Cause

The root cause is an omitted or incomplete authorization check inside a PMW code path. SAP applications rely on ABAP AUTHORITY-CHECK statements or equivalent framework-level verification. When such checks are missing or evaluated against the wrong object, the application returns restricted data to callers that should be denied.

Attack Vector

Exploitation requires local access to the SAP system with valid low-privileged credentials. No user interaction is required. The attacker invokes the affected PMW function or transaction and receives data outside their authorization profile. See SAP Note #3586013 for vendor-supplied technical details.

Detection Methods for CVE-2025-43000

Indicators of Compromise

Access to PMW transactions or function modules by users whose role assignments do not include promotion management authorizations.
Unusual volumes of read operations against promotion, pricing, or condition tables originating from non-merchandising accounts.
SAP Security Audit Log entries showing authorization failures immediately followed by successful data retrieval in PMW code paths.

Detection Strategies

Enable and review the SAP Security Audit Log (SM19/SM20) for PMW transaction access outside expected user populations.
Correlate ABAP AUTHORITY-CHECK events with subsequent RFC or dialog calls to identify authorization bypass patterns.
Baseline normal PMW usage by role and alert on deviations, especially reads by service or technical accounts.

Monitoring Recommendations

Forward SAP audit logs, change documents, and read access logs to a centralized analytics platform for cross-user correlation.
Monitor privileged role assignment changes and emergency access activations that could mask exploitation attempts.
Track outbound data flows from systems hosting PMW to detect exfiltration of promotion or pricing data.

How to Mitigate CVE-2025-43000

Immediate Actions Required

Apply the patch referenced in SAP Note #3586013 to all systems running the SAP Promotion Management Wizard.
Review PMW authorization objects and remove excessive assignments from non-merchandising users and technical accounts.
Audit recent PMW activity for signs of unauthorized data access prior to patch deployment.

Patch Information

SAP released the fix as part of its monthly Security Patch Day. Customers should download and apply the correction instructions in SAP Note #3586013 through the SAP Support Launchpad. See the SAP Security Patch Day Announcement for the full monthly bulletin and prerequisites.

Workarounds

Restrict access to PMW transactions and related function modules to a minimal set of business users pending patch application.
Tighten authorization profiles by removing wildcard values on promotion-related authorization objects.
Increase Security Audit Log verbosity for PMW code paths to enable rapid detection while remediation is scheduled.

bash

# Example: list users with access to PMW-related transactions for review
# Run in SE16/SE16N against AGR_1251 to inventory promotion authorizations
# TABLE: AGR_1251
# FIELDS: OBJECT = <PMW authorization object>, LOW/HIGH = value ranges
# Then cross-reference AGR_USERS to identify assigned users for cleanup