CVE-2025-42903CWE-204

CVE-2025-42903

Medium · published October 14, 2025

CVSS v3.1

4.3

EPSS

Percentile

25.7

In the wild

Unconfirmed

What it is

A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00335 · 25.7th percentile
Weakness: CWE-204 · Observable Response Discrepancy
Published: 2025-10-14T05:15Z

References (2)

https://me.sap.com/notes/3656781 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]

EPSS history

Timeline

14 OCT 00:17Z
User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management
cvelistv5