CVE-2025-42961

MEDIUM

SAP NetWeaver Application server for ABAP - Privilege Escalation

Title source: llm
STIX 2.1

Description

Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized reading of critical data is possible, resulting in a significant impact on the confidentiality of the information stored. However, the integrity and availability of the system remain unaffected.

References (2)

Core 2
Core References

Scores

CVSS v3 4.9
EPSS 0.0021
EPSS Percentile 43.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (15)
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 700
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 701
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 702
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 731
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 740
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 750
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 751
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 752
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 753
SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 754
... and 5 more
Published Jul 08, 2025
Tracked Since Feb 18, 2026