CVE-2025-42961: falha de média gravidade em SAP_SE SAP NetWeaver Application Server for ABAP
Missing Authorization check in SAP NetWeaver Application Server for ABAP
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.9epss 0.4%
Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized reading of critical data is possible, resulting in a significant impact on the confidentiality of the information stored. However, the integrity and availability of the system remain unaffected.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
SAP_SE · SAP NetWeaver Application Server for ABAPCVEs relacionadas — SAP_SE SAP NetWeaver Application Server for ABAP
No mesmo produto, das mais perigosas para as menos.
CVE-2025-42953HIGHMissing Authorization check in SAP NetWeaver Application Server for ABAPEPSS 0.5%CVE-2025-42989CRITICALMissing Authorization check in SAP NetWeaver Application Server for ABAPEPSS 0.4%CVE-2026-27688MEDIUMMissing Authorization check in SAP NetWeaver Application Server for ABAPEPSS 0.3%CVE-2025-42942MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAPEPSS 0.2%CVE-2025-42882MEDIUMMissing Authorization check in SAP NetWeaver Application Server for ABAPEPSS 0.2%CVE-2026-58246MEDIUMInformation Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 0.2%