CVE-2025-42930: sap_se sap business planning and consolidation Unchecked Input for Loop Condition

Vulnerability summary

CVE-2025-42930 is a medium (CVSS 6.5) Unchecked Input for Loop Condition vulnerability in sap_se sap business planning and consolidation. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.2% of scored vulnerabilities.

Timeline

1. 09-09-2025
   PublishedVulnerability first disclosed.
2. 09-09-2025
   Last modifiedVulnerability information updated.

Description

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there is no impact on confidentiality or integrity.

• CWE-606Unchecked Input for Loop ConditionThe product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.