CVE-2025-27437

MEDIUM

SAP NetWeaver Application Server ABAP - Info Disclosure

Title source: llm
STIX 2.1

Description

A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate a transaction, allowing them to access but not modify non-sensitive data without further authorization and with no effect on availability.

References (2)

Core 2
Core References

Scores

CVSS v3 4.3
EPSS 0.0017
EPSS Percentile 37.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (14)
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 700
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 701
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 702
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 731
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 740
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 750
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 751
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 752
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 753
SAP_SE/SAP NetWeaver Application Server ABAP (Virus Scan Interface) SAP_BASIS 754
... and 4 more
Published Apr 08, 2025
Tracked Since Feb 18, 2026