SAP CRM and S4HANA up to WEBCUIF 701 Interaction Center server-side request forgery

Summaryinfo

A vulnerability, which was classified as critical, has been found in SAP CRM and S4HANA. Affected by this vulnerability is an unknown functionality of the component Interaction Center. This manipulation causes server-side request forgery. This vulnerability is tracked as CVE-2025-27430. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in SAP CRM and S4HANA. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Interaction Center. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. The summary by CVE is:

Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's confidentiality. There is no impact on integrity or availability

It is possible to read the advisory at me.sap.com. This vulnerability is known as CVE-2025-27430 since 02/25/2025. The exploitation appears to be difficult. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/11/2025).

Applying a patch is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Customer Relationship Management System

Vendor

• SAP

Name

• CRM and S4HANA

Version

• 103
• 104
• 105
• 106
• 107
• 108
• 200
• 204
• 205
• 206
• 702
• 712
• 713
• 714
• 731
• 746
• 747
• 748
• 800
• 801
• BBPCRM 701
• S4CEXT 107
• S4CRM 100
• S4FND 102
• WEBCUIF 701

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion