Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

SAP Service Parts Management Privilege Escalation Risk

CVE-2025-43007 · published 1 year ago
Summary

If an attacker has already gained access to the SAP Service Parts Management system, they may be able to gain even more access privileges than they should have. This is a concern because it could allow the attacker to make unauthorized changes to the system. To mitigate this risk, ensure that all users have the correct level of access and that the system's authorization settings are properly configured.

Original advisory text
SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on confidentiality, in...
SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on confidentiality, integrity and availability of the application.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published13 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-43007 · NVD
Track software like this
Free during beta