Advisory
SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3610006
was released on
10.06.2025 and deals with
"[CVE-2025-42994] Multiple vulnerabilities in SAP MDM Server" within SAP MDM Server.
We advice you to follow the instructions, to resolve
information disclosuredenial of service
with a
high potential for exploitation
in component MDM-FN-MDS-SEC.
According to SAP Security Advisory team a workaround does not exist. It is advisable to implement the correction as part of maintenance.
Risk specification
This security note addresses multiple vulnerabilities (CVEs) in SAP MDM Server: - Memory Read Access Violation: The ReadString and Read functions in SAP MDM Server permit an authenticated attacker to send specially crafted packets, leading to a memory read access violation in the server process. This results in process termination and denial of service. - Session Hijacking and Function Execution: SAP MDM Server also contains a vulnerability that allows an unauthenticated attacker to hijack existing client sessions and execute certain functions without reauthentication. This can lead to unauthorized access or modification of non-sensitive data, or excessive resource consumption.Solution
The issue has been resolved by implementing randomized session token generation, effectively preventing unauthorized session hijacking and ensuring secure session management.
