补丁日：2025年4月
发布于 2025年4月8日 · 23 条安全说明 · 来源：SAP 安全补丁日页面
计划日期：2025年4月8日（每月第二个星期二）
- 新发布
- 21
- 更新
- 2
- 严重
- 4
- 高
- 5
- 最高 CVSS
- 10.0
- 已被利用
- 1
本月摘要
共 23 条安全说明（新发布 21 条，更新 2 条），其中严重 4 条、高 5 条，最高 CVSS 10.0。 1 条安全说明修复了已列入 CISA KEV 目录的 CVE。
优先修补
排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
Authentication Bypass Vulnerability in SAP Financial Consolidation
Improper Authorization in SAP BusinessObjects Business Intelligence platform
全部安全说明
SAP 简介中写明 18 条新安全说明和 2 条更新；SAP 表格共列出 23 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。
SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。
显示 23 / 23
| 标题 | CVE | ||||
|---|---|---|---|---|---|
| 3594142 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) 新发布补丁日之后发布已被利用 | SAP NetWeaver | 严重 | 10.0 | CVE-2025-31324 |
| 3581961 | Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise) 新发布 | SAP S/4HANA | 严重 | 9.9 | CVE-2025-27429 |
| 3587115 | Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) 新发布 | SAP Landscape Transformation | 严重 | 9.9 | CVE-2025-31330 |
| 3572688 | Authentication Bypass Vulnerability in SAP Financial Consolidation 新发布 | SAP Financial Consolidation | 严重 | 9.8 | CVE-2025-30016 |
| 3525794 | Improper Authorization in SAP BusinessObjects Business Intelligence platform 更新 | SAP BusinessObjects BI Platform | 高 | 8.8 | CVE-2025-0064 |
| 3554667 | Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 高 | 8.5 | CVE-2025-23186 |
| 3590984 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat within SAP Commerce Cloud 新发布 | SAP Commerce Cloud | 高 | 8.1 | CVE-2024-56337 |
| 2927164 | Directory Traversal vulnerability in SAP Capital Yield Tax Management 新发布 | SAP Capital Yield Tax Management | 高 | 7.7 | CVE-2025-30014 |
| 3581811 | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 高 | 7.7 | CVE-2025-27428 |
| 3543274 | Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud) 新发布 | SAP Commerce Cloud | 中 | 6.8 | CVE-2025-26654 |
| 3571093 | Code Injection vulnerability in SAP ERP BW Business Content 新发布 | SAP ERP BW Business Content | 中 | 6.7 | CVE-2025-30013 |
| 3565751 | Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform 新发布 | SAP BusinessObjects BI Platform | 中 | 6.6 | CVE-2025-31332 |
| 3568307 | Information Disclosure vulnerability in SAP KMC WPC 新发布 | SAP KMC WPC | 中 | 5.3 | CVE-2025-26657 |
| 3559307 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.7 | CVE-2025-26653 |
| 3446649 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution) 新发布补丁日之后发布 | SAP S/4HANA | 中 | 4.6 | CVE-2025-31328 |
| 3558864 | Missing Authorization check in SAP Solution Manager 新发布 | SAP Solution Manager | 中 | 4.4 | CVE-2025-30017 |
| 3359825 | OData meta-data property entity tampering in SAP Field Logistics 新发布补丁日之后发布 | SAP Field Logistics | 中 | 4.3 | CVE-2025-31327 |
| 3525971 | Odata meta-data tampering in SAP S4CORE entity 新发布 | SAP S4CORE entity | 中 | 4.3 | CVE-2025-31333 |
| 3568778 | Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface) 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.3 | CVE-2025-27437 |
| 3577131 | Authorization Bypass vulnerability in SAP NetWeaver 新发布 | SAP NetWeaver | 中 | 4.3 | CVE-2025-31331 |
| 3539465 | Information Disclosure Vulnerability in SAP Commerce Cloud 新发布 | SAP Commerce Cloud | 中 | 4.2 | CVE-2025-27435 |
| 3565944 | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.1 | CVE-2025-30015 |
| 3561861 | Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center) 更新 | SAP CRM and SAP S/4HANA | 低 | 3.5 | CVE-2025-27430 |