CVE-2025-42934
Severity CVSS v4.0:
Pending analysis
Type:
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Publication date:
12/08/2025
Last modified:
12/08/2025
Description
SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites' configuration by injecting line feed (LF) characters into application inputs. This vulnerability has a low impact on the application's integrity and no impact on confidentiality or availability.
Impact
Base Score 3.x
4.30
Severity 3.x
MEDIUM