CVE-2025-0063
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 700 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 701 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 702 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 731 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 740 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 750 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 751 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 752 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 753 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 754 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 755 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 756 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 757 | affected |
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 758 | affected |
Weaknesses
- CWE-89: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.