Description
Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application.
References (2)
Core 2
Core References
Vendor Advisory
https://url.sap/sapsecuritypatchday
Vendor Advisory
https://me.sap.com/notes/3563927
Scores
CVSS v3
8.8
EPSS
0.0010
EPSS Percentile
26.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-862
Status
published
Products (15)
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 700
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 701
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 702
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 731
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 740
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 750
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 751
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 752
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 753
SAP_SE/SAP NetWeaver (ABAP Class Builder)
SAP_BASIS 754
... and 5 more
Published
Mar 11, 2025
Tracked Since
Feb 18, 2026