CVE-2025-42875

Summary

The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 700affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 701affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 702affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 731affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 740affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 750affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 751affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 752affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 753affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 754affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 755affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 756affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 757affected
SAP_SESAP NetWeaver Internet Communication FrameworkSAP_BASIS 758affected

Weaknesses

  • CWE-306: CWE-306: Missing Authentication for Critical Function

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References