CVE-2025-23190

MEDIUM

SAP NetWeaver and ABAP Platform ST-PI - Missing Authorization Check

Title source: llm
STIX 2.1

Description

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.

References (2)

Core 2
Core References

Scores

CVSS v3 4.3
EPSS 0.0008
EPSS Percentile 22.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (3)
SAP_SE/SAP NetWeaver and ABAP platform (ST-PI) ST-PI 2008_1_700
SAP_SE/SAP NetWeaver and ABAP platform (ST-PI) ST-PI 2008_1_710
SAP_SE/SAP NetWeaver and ABAP platform (ST-PI) ST-PI 740
Published Feb 11, 2025
Tracked Since Feb 18, 2026