CVE-2025-0067

MEDIUM

SAP NetWeaver Application Server Java - Info Disclosure

Title source: llm
STIX 2.1

Description

Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.

References (2)

Core 2
Core References

Scores

CVSS v3 6.3
EPSS 0.0006
EPSS Percentile 17.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
SAP_SE/SAP NetWeaver Application Server Java WD-RUNTIME 7.50
Published Jan 14, 2025
Tracked Since Feb 18, 2026