CVE-2025-42936

MEDIUM

SAP NetWeaver Application Server for ABAP - Authenticated Privilege Escalation via Barcode Interface

Title source: llm

Description

The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.

References (2)

Core 2

Core References

Permissions Required

https://me.sap.com/notes/3602656

Patch

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 5.4

EPSS 0.0005

EPSS Percentile 16.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-266

Status published

Products (15)

sap/sap_basis 700

sap/sap_basis 701

sap/sap_basis 702

sap/sap_basis 731

sap/sap_basis 740

sap/sap_basis 750

sap/sap_basis 751

sap/sap_basis 752

sap/sap_basis 753

sap/sap_basis 754

... and 5 more

Published Aug 12, 2025

Tracked Since Feb 18, 2026