Auth bypass in Sap Se Digital Manufacturing (Production Operator Dashboard)
CVE-2025-43004
Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data when they access these dashboards. Since no mechanisms exist to enforce authentication, malicious unauthenticated users can view non-sensitive customer information. However, this does not affect data integrity or availability.
Vulnerability class: Broken Access Control
EPSS: 0.003 (23.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Sap_se Sap Digital Manufacturing (Production Operator Dashboard) — versions CTNR-DME-PODFOUNDATION-MS 1.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-43004?
- CVE-2025-43004 is a medium-severity vulnerability in Sap Se Digital Manufacturing (Production Operator Dashboard), classified under Missing Authorization. CVSS score: 5.3/10. Published 2025-05-13.
- How severe is CVE-2025-43004?
- Medium severity. CVSS v3 base score is 5.3 out of 10.