CVE-2025-23187

MEDIUM

SAP NetWeaver/ABAP Platform < ST-PI 2008_1_700/710/740 - Unauthenticated Missing Authorization in SDCCN

Title source: llm

Description

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability.

References (2)

Core 2

Core References

Vendor Advisory

https://me.sap.com/notes/3546470

Vendor Advisory

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 5.3

EPSS 0.0016

EPSS Percentile 36.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (3)

SAP_SE/SAP NetWeaver and ABAP Platform (SDCCN) ST-PI 2008_1_700

SAP_SE/SAP NetWeaver and ABAP Platform (SDCCN) ST-PI 2008_1_710

SAP_SE/SAP NetWeaver and ABAP Platform (SDCCN) ST-PI 740

Published Feb 11, 2025

Tracked Since Feb 18, 2026