{"id":13067,"date":"2025-04-14T10:14:49","date_gmt":"2025-04-14T08:14:49","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=13067"},"modified":"2025-04-14T10:14:49","modified_gmt":"2025-04-14T08:14:49","slug":"sap-security-notes-april-2025","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/","title":{"rendered":"SAP Security Notes, April 2025"},"content":{"rendered":"<p><strong>Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.<\/strong><\/p>\n\n<h2>April 2025 Notes<\/h2>\n<h3>Summary and Highlights of the Month<\/h3>\n<div>This month the total number of notes is 20, 5 less than in the previous period. This month, 3 Hot News have been published, 3 more than in the previous period. Regarding High Priority notes, 5 notes have been published, the same number as in the previous period. Medium and Low Priority notes will not be reviewed, so we will provide details on a total of <b>8 notes<\/b> (all with a CVSS score of <b>7<\/b> or higher).We have a <b>total of 20 notes<\/b> for the whole month (18 new notes and 2 updates of notes published in previous months).<\/p>\n<p>We will review in detail a total of 8 notes, all High Priority and Hot News:<\/p>\n<ol start=\"1\">\n<li>\n<div><b>The most critical notes of the month (CVSS <\/b><span style=\"color: #ff0000;\"><b>9.9<\/b><\/span><b>)<\/b> are 2 Hot News, both related to <b>&#8220;Code Injection Vulnerability&#8221;<\/b>: one for SAP S\/4 HANA <b>\u201cCode Injection Vulnerability in SAP S\/4HANA (Private Cloud)\u201d<\/b> and the other for SLT <b>\u201cCode Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)\u201d<\/b><\/div>\n<\/li>\n<li>\n<div>The next most critical note <b>(CVSS <\/b><span style=\"color: #ff0000;\"><b>9.8<\/b><\/span><b>)<\/b> is a Hot News related to <b>\u201cAuthentication Bypass Vulnerability in SAP Financial Consolidation\u201d<\/b><\/div>\n<\/li>\n<li>\n<div>The next in severity <b>(CVSS <\/b><span style=\"color: #ff0000;\"><b>8.8<\/b><\/span><b>)<\/b> is an update of a note published in February this year, related to <b>\u201cImproper Authorization in SAP BusinessObjects Business Intelligence platform\u201d<\/b><\/div>\n<\/li>\n<li>The next in severity <b>(CVSS <\/b><span style=\"color: #ff0000;\"><b>8.5<\/b><\/span><b>)<\/b> is a note related to <b>\u201cMixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP\u201d<\/b><\/li>\n<li>The next in severity <b>(CVSS <\/b><span style=\"color: #ff0000;\"><b>8.1<\/b><\/span><b>)<\/b> is a note related to <b>\u201cTime-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat within SAP Commerce Cloud\u201d<\/b><\/li>\n<li>\n<div>Finally, we have 2 High Priority notes <b>(CVSS <\/b><b><span style=\"color: #ffcc00;\">7.7<\/span>)<\/b>: one related to <b>\u201cDirectory Traversal vulnerability in SAP Capital Yield Tax Management\u201d<\/b> and another related to <b>\u201cDirectory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)\u201d<\/b><\/div>\n<\/li>\n<li>\n<div>This month, the most common type of vulnerability is <b>&#8220;Code Injection Vulnerability&#8221;<\/b> (3 out of 20 on Patch Day)<\/div>\n<div><\/div>\n<\/li>\n<\/ol>\n<p>In the chart, we can see the <b><u>classification of April&#8217;s notes<\/u><\/b>, as well as the trend and classification of the last 5 previous months (only the notes from Sec. Tuesday \/ Patch Day \u2013 by SAP):<\/p>\n<\/div>\n<p><img decoding=\"async\" class=\"aligncenter  wp-image-13069\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025.jpg\" alt=\"\" width=\"801\" height=\"421\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025.jpg 1200w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025-300x158.jpg 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025-1024x538.jpg 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025-600x315.jpg 600w\" sizes=\"(max-width: 801px) 100vw, 801px\" \/><\/p>\n<h3>Full details<\/h3>\n<p>The <strong>complete detail of the most relevant notes<\/strong> is as follows:<\/p>\n<ol start=\"1\">\n<li>\n<div><b>Code Injection Vulnerability in SAP S\/4HANA (Private Cloud)<u>\u00a0(<\/u><\/b><b><u><a id=\"OWA5d70ff57-b80a-4057-26cf-6769962ed1e0\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/me.sap.com\/notes\/3581961\" href=\"https:\/\/me.sap.com\/notes\/3581961\" data-auth=\"NotApplicable\" data-linkindex=\"0\">3581961<\/a><\/u><\/b><b><u>)<\/u>:<\/b>\u00a0SAP S\/4HANA has a vulnerability that allows a privileged attacker to inject arbitrary ABAP code through a function module exposed via RFC. This bypasses authorization checks and acts as a backdoor, compromising the system&#8217;s confidentiality, integrity, and availability, potentially leading to a full system takeover.<b>\u00a0CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>9,9<\/b><\/span><b>\/ 10 [<\/b><b><u><a id=\"OWAe3df7d55-8ce7-133c-6813-66e008d81b65\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-27429\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-27429\" data-auth=\"NotApplicable\" data-linkindex=\"1\">CVE-2025-27429<\/a><\/u><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div><b>Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)<u>\u00a0(<\/u><\/b><b><u><a id=\"OWAe1a0084a-947f-ccbf-51ba-07201d9a9eab\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/me.sap.com\/notes\/3587115\" href=\"https:\/\/me.sap.com\/notes\/3587115\" data-auth=\"NotApplicable\" data-linkindex=\"2\">3587115<\/a><\/u><\/b><b><u>)<\/u>: <\/b>SAP Landscape Transformation (SLT) has a vulnerability that allows an attacker with user privileges to inject arbitrary ABAP code through a function module exposed via RFC. This bypasses authorization checks and acts as a backdoor, compromising the system&#8217;s confidentiality, integrity, and availability, potentially leading to a full system takeover. <b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>9,9<\/b><\/span><b>\/ 10 [<\/b><b><u><a id=\"OWAa581aa5f-5d7a-b64c-ac06-0854fb7d6b9f\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-31330\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-31330\" data-auth=\"NotApplicable\" data-linkindex=\"3\">CVE-2025-31330<\/a><\/u><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div><b>Authentication Bypass Vulnerability in SAP Financial Consolidation (<\/b><b><u><a id=\"OWAb34c94f3-6494-538a-0569-c98c45356e61\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/me.sap.com\/notes\/3572688\" href=\"https:\/\/me.sap.com\/notes\/3572688\" data-auth=\"NotApplicable\" data-linkindex=\"4\">3572688<\/a><\/u><\/b><b>) <\/b>SAP Financial Consolidation has a vulnerability that allows an unauthenticated attacker to gain unauthorized access to the Admin account. This issue stems from improper authentication mechanisms, which significantly impact the Confidentiality, Integrity, and Availability of the application.<b>\u00a0CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>9,8<\/b><\/span><b>\/ 10\u00a0 [<\/b><b><u><a id=\"OWA056ea344-f0fc-5d2b-cfb6-7f78d2f8f23b\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-30016\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-30016\" data-auth=\"NotApplicable\" data-linkindex=\"5\">CVE-2025-30016<\/a><\/u><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div><b>Update &#8211; \u00a0<\/b>Improper Authorization in SAP BusinessObjects Business Intelligence platform<b>\u00a0(<\/b><b><u><a id=\"OWA21cc5da3-20d6-3637-671d-05d12c98812a\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/me.sap.com\/notes\/3525794\" href=\"https:\/\/me.sap.com\/notes\/3525794\" data-auth=\"NotApplicable\" data-linkindex=\"6\">3525794<\/a><\/u><\/b><b>): <\/b>Under specific conditions, SAP BusinessObjects Business Intelligence platform allows an attacker with user rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system by accessing the target system locally. This vulnerability has a high impact on the confidentiality, integrity, and availability of the application. Additionally, it requires manual activities.<b>\u00a0CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>8,8<\/b><\/span><b>\/ 10\u00a0 [<\/b><b><u><a id=\"OWA20efe301-fb0a-3958-3003-f5205ec71693\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-0064\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-0064\" data-auth=\"NotApplicable\" data-linkindex=\"11\">CVE-2025-0064<\/a><\/u><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div><b>Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP (<\/b><b><u><a id=\"OWA7c7091e5-9d77-802e-ca1a-2d0ecc568ab1\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/me.sap.com\/notes\/3554667\" href=\"https:\/\/me.sap.com\/notes\/3554667\" data-auth=\"NotApplicable\" data-linkindex=\"12\">3554667<\/a><\/u><\/b><b>): <\/b>Under certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, potentially exposing credentials for a remote service. These credentials can then be exploited to completely compromise the remote service, which can significantly impact the confidentiality, integrity, and availability of the application. The note also includes a workaround.<b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>8,5<\/b><\/span><b>\/ 10\u00a0 [<\/b><b><u><a id=\"OWA9c38a9fa-2a6b-35eb-f2e7-b4b3306efedd\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-23186\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-23186\" data-auth=\"NotApplicable\" data-linkindex=\"19\">CVE-2025-23186<\/a><\/u><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div><b>Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat within SAP Commerce Cloud (<\/b><b><u><a id=\"OWA170ace1d-b593-a703-94f5-2aa96081e8f1\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/me.sap.com\/notes\/3590984\" href=\"https:\/\/me.sap.com\/notes\/3590984\" data-auth=\"NotApplicable\" data-linkindex=\"20\">3590984<\/a><\/u><\/b><b>):<\/b>\u00a0If successfully exploited, the vulnerability could fully compromise the system&#8217;s confidentiality, integrity, and availability. However, the success of this exploitation depends on a server setting that remains beyond the attacker&#8217;s control, and SAP Commerce is not exploitable out of the box. To resolve this, it is recommended to apply the recommended patches, as no workaround is available.( <b><u><a id=\"OWAb4df2608-b76b-a9b1-4274-61f89add6245\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-56337\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-56337\" data-auth=\"NotApplicable\" data-linkindex=\"21\">CVE-2024-56337<\/a><\/u><\/b>\u00a0).<b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>8,1<\/b><\/span><b>\/ 10 [<\/b><b><u><a id=\"OWA84322308-5eb8-73aa-f05b-731f70d9fe07\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-56337\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-56337\" data-auth=\"NotApplicable\" data-linkindex=\"30\">CVE-2024-56337<\/a><\/u><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div><b>Directory Traversal vulnerability in SAP Capital Yield Tax Management (<\/b><b><u><a id=\"OWA1e1081eb-4ce7-7aed-46cb-b6d9e1a0fce6\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/me.sap.com\/notes\/2927164\" href=\"https:\/\/me.sap.com\/notes\/2927164\" data-auth=\"NotApplicable\" data-linkindex=\"31\">2927164<\/a><\/u><\/b><b>): <\/b>SAP Capital Yield Tax Management has a directory traversal vulnerability due to insufficient path validation. This allows an attacker with low privileges to read files from directories they don\u2019t have access to, resulting in a high impact on confidentiality. Integrity and availability are not affected. <b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ffcc00;\"><b>7,7<\/b><\/span><b>\/ 10 [<\/b><b><u><a id=\"OWAb8b978ba-ead6-73a6-a16d-1f982281854c\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-27428\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-27428\" data-auth=\"NotApplicable\" data-linkindex=\"32\">CVE-2025-<\/a>30014<\/u><\/b><b>]<\/b><\/div>\n<\/li>\n<\/ol>\n<ol start=\"8\">\n<li>\n<div><b>Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) (<\/b><b><u><a id=\"OWA551e28a2-94d4-ea4d-f504-cb0194853ee5\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/me.sap.com\/notes\/3581811\" href=\"https:\/\/me.sap.com\/notes\/3581811\" data-auth=\"NotApplicable\" data-linkindex=\"33\">3581811<\/a><\/u><\/b><b>):<\/b>Due to a directory traversal vulnerability, an authorized attacker could gain access to critical information by using an RFC-enabled function module. If successfully exploited, the attacker could read files from any managed system connected to SAP Solution Manager, resulting in a high impact on confidentiality. There is no impact on integrity or availability. <b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ffcc00;\"><b>7,7<\/b><\/span><b>\/ 10 [<\/b><b><u><a id=\"OWA1e69cbf2-c8bc-a4d2-c5ed-db51de23e1ff\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-27428\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-27428\" data-auth=\"NotApplicable\" data-linkindex=\"34\">CVE-2025-27428<\/a><\/u><\/b><b>]<\/b><\/div>\n<\/li>\n<\/ol>\n<h3 style=\"font-weight: 400;\"><strong>Reference links<\/strong><\/h3>\n<p>Other references, from SAP and Onapsis (april):<\/p>\n<p><b><u><a id=\"OWA3d4415fd-b2ab-d721-aad2-2b66cf436c60\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/support.sap.com\/en\/my-support\/knowledge-base\/security-notes-news\/april-2025.html\" href=\"https:\/\/support.sap.com\/en\/my-support\/knowledge-base\/security-notes-news\/april-2025.html\" data-auth=\"NotApplicable\" data-linkindex=\"35\">SAP Security Patch Day &#8211; April 2025<\/a><\/u><\/b><\/p>\n<p><b><u><a id=\"OWA345a2f15-e1af-d532-642f-a992daa5b2ca\" class=\"x_x_x_x_x_x_x_x_x_OWAAutoLink\" title=\"https:\/\/onapsis.com\/blog\/sap-patch-day-april-2025\/\" href=\"https:\/\/onapsis.com\/blog\/sap-patch-day-april-2025\/\" data-auth=\"NotApplicable\" data-linkindex=\"36\">SAP Patch Day: April 2025 &#8211; Onapsis<\/a><\/u><\/b><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong style=\"color: #014888; font-family: inherit; font-size: 1.6rem; letter-spacing: 0em;\"><u>Resources affected<\/u><\/strong><\/p>\n<div class=\"w-post-elm post_content\">\n<div>\n<ul>\n<li>SAP S\/4HANA (Private Cloud), Versions &#8211; S4CORE 102, 103, 104, 105, 106, 107, 108<\/li>\n<li>SAP Landscape Transformation (Analysis Platform), Versions &#8211; DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731<\/li>\n<li>SAP BusinessObjects Business Intelligence platform (Central Management Console), Versions &#8211; ENTERPRISE 430, 2025<\/li>\n<li>SAP NetWeaver Application Server ABAP, Versions &#8211; KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93<\/li>\n<li>SAP Commerce Cloud, Versions &#8211; HY_COM 2205, COM_CLOUD 2211<\/li>\n<li>SAP Capital Yield Tax Management, Versions &#8211; CYTERP 420_700, CYT 800, IBS 7.0, CYT4HANA 100<\/li>\n<li>SAP NetWeaver and ABAP Platform (Service Data Collection), Versions &#8211; ST-PI 2008_1_700, 2008_1_710, 740<\/li>\n<li>SAP Commerce Cloud (Public Cloud), Version &#8211; COM_CLOUD 2211<\/li>\n<li>SAP ERP BW Business Content, Versions &#8211; BI_CONT 707, 737, 747, 757<\/li>\n<li>SAP BusinessObjects Business Intelligence Platform, Version &#8211; ENTERPRISE 430<\/li>\n<li>SAP KMC WPC, Version &#8211; KMC-WPC 7.50<\/li>\n<li>SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML), Versions &#8211; KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.14<\/li>\n<li>SAP Solution Manager, Versions &#8211; ST 720, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 914<\/li>\n<li>SAP S4CORE entity, Versions &#8211; S4CORE 107, 108<\/li>\n<li>SAP NetWeaver Application Server ABAP (Virus Scan Interface), Versions &#8211; SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758<\/li>\n<li>SAP NetWeaver, Versions &#8211; SAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, 75I<\/li>\n<li>SAP NetWeaver and ABAP Platform (Application Server ABAP), Versions &#8211; KRNL64UC 7.53, KERNEL 7.53, 7.54<\/li>\n<li>SAP CRM and SAP S\/4HANA (Interaction Center), Versions &#8211; S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800, 801<\/li>\n<\/ul>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems. April 2025 Notes Summary and Highlights of the Month This month the total number of notes is 20, 5 less than in the previous period. This month, 3 Hot News have been published,&#8230;<\/p>\n","protected":false},"author":6,"featured_media":13069,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[95,61],"tags":[150],"class_list":["post-13067","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sap-notes","category-sap-security-en-2","tag-sap-notes"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.3 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>SAP Security Notes, April 2025 - Inprosec<\/title>\n<meta name=\"description\" content=\"All updates to SAP systems notes from april 2025, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SAP Security Notes, April 2025\" \/>\n<meta property=\"og:description\" content=\"All updates to SAP systems notes from april 2025, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-14T08:14:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"SAP Security Notes, April 2025\",\"datePublished\":\"2025-04-14T08:14:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/\"},\"wordCount\":1196,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/notas-sap-abril-l2025.jpg\",\"keywords\":[\"SAP Notes\"],\"articleSection\":[\"SAP Notes\",\"SAP Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/\",\"name\":\"SAP Security Notes, April 2025 - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/notas-sap-abril-l2025.jpg\",\"datePublished\":\"2025-04-14T08:14:49+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"All updates to SAP systems notes from april 2025, to stay current and improve the security levels of your SAP systems.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/notas-sap-abril-l2025.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/notas-sap-abril-l2025.jpg\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-april-2025\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SAP Security Notes, April 2025\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SAP Security Notes, April 2025 - Inprosec","description":"All updates to SAP systems notes from april 2025, to stay current and improve the security levels of your SAP systems.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/","og_locale":"en_US","og_type":"article","og_title":"SAP Security Notes, April 2025","og_description":"All updates to SAP systems notes from april 2025, to stay current and improve the security levels of your SAP systems.","og_url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/","og_site_name":"Inprosec","article_published_time":"2025-04-14T08:14:49+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"SAP Security Notes, April 2025","datePublished":"2025-04-14T08:14:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/"},"wordCount":1196,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025.jpg","keywords":["SAP Notes"],"articleSection":["SAP Notes","SAP Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/","url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/","name":"SAP Security Notes, April 2025 - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025.jpg","datePublished":"2025-04-14T08:14:49+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"All updates to SAP systems notes from april 2025, to stay current and improve the security levels of your SAP systems.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/04\/notas-sap-abril-l2025.jpg","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2025\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"SAP Security Notes, April 2025"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/13067","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=13067"}],"version-history":[{"count":2,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/13067\/revisions"}],"predecessor-version":[{"id":13123,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/13067\/revisions\/13123"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/13069"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=13067"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=13067"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=13067"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}