CVE-2025-43002: SAP S4CORE OData Information Disclosure

CVE-2025-43002 Overview

CVE-2025-43002 affects the SAP S4CORE component of SAP S/4HANA. An authenticated attacker can access restricted information exposed through an OData metadata property because the application skips a required authorization check. The flaw maps to CWE-472: External Control of Assumed-Immutable Web Parameter and is exploitable over the network with low privileges and no user interaction. Successful exploitation causes limited confidentiality impact. Integrity and availability of the application remain unaffected. SAP disclosed the issue on its May 2025 Security Patch Day.

Critical Impact
Authenticated attackers can retrieve restricted metadata from SAP S/4HANA OData services without a valid authorization check, exposing information that should be limited to privileged users.

Affected Products

SAP S/4HANA (S4CORE component)
OData services exposed by the affected S4CORE release
SAP customers using the vulnerable S4CORE version referenced in SAP Note 3227940

Discovery Timeline

2025-05-13 - CVE-2025-43002 published to NVD as part of SAP Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43002

Vulnerability Analysis

The vulnerability resides in an OData metadata property exposed by the SAP S4CORE component. OData services publish metadata documents that describe entity sets, properties, and relationships. In the affected S4CORE release, a metadata property returns restricted information without validating that the caller is authorized to view it. Any authenticated user with a valid SAP session can query the endpoint and receive data that should be gated behind a role or authorization object check. The impact is limited to information disclosure and does not permit modification or service disruption. Attackers can use disclosed information to enumerate business objects and refine follow-on attacks against the S/4HANA landscape.

Root Cause

The root cause is a missing authorization check in the OData metadata handling logic (CWE-472). The service implementation assumes the metadata property is safe to expose to any authenticated caller. It does not validate the user's SAP authorization objects before returning the property value. This trust assumption allows any logged-in user, including low-privilege accounts, to bypass segregation-of-duties controls.

Attack Vector

Exploitation is remote and requires only authenticated access to the SAP application. An attacker sends a crafted request to the vulnerable OData metadata endpoint using standard HTTP tooling. No user interaction, no privilege escalation, and no chaining with additional vulnerabilities are required. The Exploit Prediction Scoring System (EPSS) rates the probability of exploitation activity in the near term as low. No public proof-of-concept exploit is currently listed for this CVE, and CISA has not added it to the Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. Refer to the SAP Note 3227940 for authoritative technical details and remediation instructions.

Detection Methods for CVE-2025-43002

Indicators of Compromise

Unexpected authenticated requests to OData metadata endpoints (/sap/opu/odata/.../$metadata or associated property URIs) from low-privilege user accounts.
Repeated enumeration patterns against S/4HANA OData services, particularly from accounts that do not routinely access business data.
Anomalous data volume in HTTP responses returned from S4CORE OData services to non-administrative users.

Detection Strategies

Review SAP Gateway logs and ICM logs for OData metadata requests correlated with user roles that should not access the disclosed properties.
Enable SAP Security Audit Log filters for RFC and OData access from generic or service accounts and alert on unusual endpoints.
Baseline normal OData traffic per user role and flag deviations in request paths or response sizes.

Monitoring Recommendations

Forward SAP Gateway, ICM, and Security Audit Log events to a SIEM for correlation with identity and role data.
Monitor authentication anomalies such as low-privilege users issuing high-frequency OData queries.
Track and alert on access to the specific metadata endpoints listed in SAP Note 3227940 after applying the patch.

How to Mitigate CVE-2025-43002

Immediate Actions Required

Apply the SAP-provided patch referenced in SAP Note 3227940 to affected S4CORE systems.
Inventory all SAP S/4HANA landscapes and identify systems running the vulnerable S4CORE release.
Restrict network access to SAP OData endpoints so that only trusted clients and integration systems can reach them.
Review authorization assignments for accounts that can authenticate to the affected OData services.

Patch Information

SAP released the fix as part of its May 2025 Security Patch Day. Customers should download and apply the correction instructions from SAP Note 3227940. Additional context is available on the SAP Security Patch Day portal. Follow SAP's standard patch validation procedure in a non-production system before rolling out to production.

Workarounds

If patching must be delayed, restrict access to the vulnerable OData metadata endpoints at the SAP Web Dispatcher or reverse proxy layer.
Reduce the number of users granted authentication to the affected S/4HANA system while remediation is planned.
Increase Security Audit Log verbosity for OData services and review access reports daily until the patch is deployed.

bash

# Configuration example - reference only
# Consult SAP Note 3227940 for authoritative remediation steps
# Example: restrict OData metadata paths at the SAP Web Dispatcher
# icm/HTTP/mod_0 = PREFIX=/sap/opu/odata/,FILE=$(DIR_PROFILE)/rewrite.txt
# In rewrite.txt, deny requests to the affected metadata property for untrusted networks