CVE-2025-23186: falha de alta gravidade em SAP_SE SAP NetWeaver Application Server ABAP
Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.5%
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
SAP_SE · SAP NetWeaver Application Server ABAPCVEs relacionadas — SAP_SE SAP NetWeaver Application Server ABAP
No mesmo produto, das mais perigosas para as menos.
CVE-2024-54198HIGHInformation Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAPEPSS 0.6%CVE-2026-44747CRITICALMemory Corruption vulnerability in SAP NetWeaver Application Server ABAPEPSS 0.6%CVE-2024-47593MEDIUMInformation Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 0.4%CVE-2026-66779MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAPEPSS 0.3%CVE-2024-41732MEDIUMImproper Access Control in SAP Netweaver Application Server ABAPEPSS 0.3%CVE-2025-0068MEDIUMMissing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAPEPSS 0.3%