CVE-2025-43001
MEDIUM EPSS 3.7%
Published Jul 8, 202511mo ago · Modified Jun 17, 20261w ago
6.9 CVSS 3.1
Published Jul 8, 2025 11mo ago
Last Modified Jun 17, 2026 1w ago
Description
SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting the archive, leading to privilege escalation. On successful exploitation, an attacker could modify the critical files by tampering with signed archives without breaking the signature, but it has a low impact on the confidentiality and availability of the system.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L Attack Vector Local
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity High
Availability Low
Threat Intelligence
EPSS Exploit Probability
3.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-266
References 2
- me.sap.com https://me.sap.com/notes/3595143
- url.sap https://url.sap/sapsecuritypatchday
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.