4.3

CVE-2025-42968

Missing Authorization check in SAP NetWeaver (RFC enabled function module)

SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Netweaver Version 700
SAP ≫ Netweaver Version 701
SAP ≫ Netweaver Version 702
SAP ≫ Netweaver Version 710
SAP ≫ Netweaver Version 731
SAP ≫ Netweaver Version 740
SAP ≫ Netweaver Version 750
SAP ≫ Netweaver Version 751
SAP ≫ Netweaver Version 752
SAP ≫ Netweaver Version 753
SAP ≫ Netweaver Version 754
SAP ≫ Netweaver Version 755
SAP ≫ Netweaver Version 756
SAP ≫ Netweaver Version 757
SAP ≫ Netweaver Version 758
SAP ≫ Netweaver Version 816
SAP ≫ Netweaver Version 914
SAP ≫ Netweaver Version 916
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.163
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SAP 5 3.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://url.sap/sapsecuritypatchday
Patch
https://me.sap.com/notes/3621037
Permissions Required