CVE-2025-42947 Code Injection vulnerability in SAP FICA ODN framework
A high-privileged user can inject code into the SAP FICA ODN framework, allowing control over application behavior and compromising integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-42947?
CVE-2025-42947 is a medium-severity code injection vulnerability in SAP_SE SAP FICA ODN framework, published on 23 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on confidentiality of the application.
Weakness: CWE-94
Which versions are affected by CVE-2025-42947?
How do I fix CVE-2025-42947?
No fix has been published for CVE-2025-42947 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-42947 being exploited?
There is no known exploitation of CVE-2025-42947 in the wild and no public exploit code.
Sources
Also known as GHSA-24w5-rq2q-cf4c.