CVE-2025-42882

MEDIUM

SAP NetWeaver Application Server for ABAP - Info Disclosure

Title source: llm
STIX 2.1

Description

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact on confidentiality, with no impact on the integrity or availability of the application.

References (2)

Core 2
Core References

Scores

CVSS v3 4.3
EPSS 0.0003
EPSS Percentile 10.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (15)
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 700
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 701
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 702
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 731
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 740
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 750
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 751
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 752
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 753
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 754
... and 5 more
Published Nov 11, 2025
Tracked Since Feb 18, 2026