CVE-2025-43010 Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))
An authenticated attacker can execute arbitrary ABAP code by exploiting missing input validation in SAP S/4HANA SCM Master Data Layer.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-43010?
CVE-2025-43010 is a high-severity code injection vulnerability in SAP_SE SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)), published on 13 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation and no authorization checks. This has low Confidentiality impact but high impact on integrity and availability to the application.
Weakness: CWE-94
Which versions are affected by CVE-2025-43010?
How do I fix CVE-2025-43010?
No fix has been published for CVE-2025-43010 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-43010 being exploited?
There is no known exploitation of CVE-2025-43010 in the wild and no public exploit code.
Sources
Also known as GHSA-94gr-9qc8-c44p.