CVE-2025-42918

MEDIUM EPSS 10.0%
Published Sep 9, 20259mo ago · Modified Jun 17, 20261w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Sep 9, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
10.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 15

VendorProductVersionRange
sapsap_basis700any
sapsap_basis701any
sapsap_basis702any
sapsap_basis731any
sapsap_basis740any
sapsap_basis750any
sapsap_basis751any
sapsap_basis752any
sapsap_basis753any
sapsap_basis754any
sapsap_basis755any
sapsap_basis756any
sapsap_basis757any
sapsap_basis758any
sapsap_basis816any

References 2

  • me.sap.com https://me.sap.com/notes/3623504
    Permissions Required
  • url.sap https://url.sap/sapsecuritypatchday
    Patch

Remediation

  • url.sap https://url.sap/sapsecuritypatchday
    Patch