CVE-2025-42903 User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management
Attackers can enumerate users and expose personal data via response discrepancies in the RFC function, impacting confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-42903?
CVE-2025-42903 is a medium-severity vulnerability in SAP_SE SAP Financial Service Claims Management, published on 14 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability.
Weakness: CWE-204
Which versions are affected by CVE-2025-42903?
How do I fix CVE-2025-42903?
No fix has been published for CVE-2025-42903 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-42903 being exploited?
There is no known exploitation of CVE-2025-42903 in the wild and no public exploit code.
Sources
Also known as GHSA-3xm3-c6m3-m8wf.