Vulnerability-Lookup

CVE-2025-42968 (GCVE-0-2025-42968)

Vulnerability from cvelistv5 – Published: 2025-07-08 00:36 – Updated: 2025-07-08 16:13

Title

Missing Authorization check in SAP NetWeaver (RFC enabled function module)

Summary

SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-08 14:29 UTC

CWE

CWE-862 - Missing Authorization

Assigner

sap mitre root

References

2 references

URL	Tags
https://me.sap.com/notes/3621037
https://url.sap/sapsecuritypatchday

Impacted products

1 product

Vendor	Product	Version	CPE status
SAP_SE	SAP NetWeaver (RFC enabled function module)	Affected: SAP_BW 700 Affected: 701 Affected: 702 Affected: 710 Affected: 731 Affected: 740 Affected: 750 Affected: 751 Affected: 752 Affected: 753 Affected: 754 Affected: 755 Affected: 756 Affected: 757 Affected: 758 Affected: 816 Affected: 914 Affected: 916	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T14:29:01.927973Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T16:13:36.672Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver (RFC enabled function module)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BW 700"
            },
            {
              "status": "affected",
              "version": "701"
            },
            {
              "status": "affected",
              "version": "702"
            },
            {
              "status": "affected",
              "version": "710"
            },
            {
              "status": "affected",
              "version": "731"
            },
            {
              "status": "affected",
              "version": "740"
            },
            {
              "status": "affected",
              "version": "750"
            },
            {
              "status": "affected",
              "version": "751"
            },
            {
              "status": "affected",
              "version": "752"
            },
            {
              "status": "affected",
              "version": "753"
            },
            {
              "status": "affected",
              "version": "754"
            },
            {
              "status": "affected",
              "version": "755"
            },
            {
              "status": "affected",
              "version": "756"
            },
            {
              "status": "affected",
              "version": "757"
            },
            {
              "status": "affected",
              "version": "758"
            },
            {
              "status": "affected",
              "version": "816"
            },
            {
              "status": "affected",
              "version": "914"
            },
            {
              "status": "affected",
              "version": "916"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.\u003c/p\u003e"
            }
          ],
          "value": "SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T00:36:31.953Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3621037"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Authorization check in SAP NetWeaver (RFC enabled function module)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2025-42968",
    "datePublished": "2025-07-08T00:36:31.953Z",
    "dateReserved": "2025-04-16T13:25:42.158Z",
    "dateUpdated": "2025-07-08T16:13:36.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-42968",
      "date": "2026-09-20",
      "epss": "0.00247",
      "percentile": "0.16262"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP NetWeaver (RFC enabled function module)",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "SAP_BW 700"
                  },
                  {
                    "status": "affected",
                    "version": "701"
                  },
                  {
                    "status": "affected",
                    "version": "702"
                  },
                  {
                    "status": "affected",
                    "version": "710"
                  },
                  {
                    "status": "affected",
                    "version": "731"
                  },
                  {
                    "status": "affected",
                    "version": "740"
                  },
                  {
                    "status": "affected",
                    "version": "750"
                  },
                  {
                    "status": "affected",
                    "version": "751"
                  },
                  {
                    "status": "affected",
                    "version": "752"
                  },
                  {
                    "status": "affected",
                    "version": "753"
                  },
                  {
                    "status": "affected",
                    "version": "754"
                  },
                  {
                    "status": "affected",
                    "version": "755"
                  },
                  {
                    "status": "affected",
                    "version": "756"
                  },
                  {
                    "status": "affected",
                    "version": "757"
                  },
                  {
                    "status": "affected",
                    "version": "758"
                  },
                  {
                    "status": "affected",
                    "version": "816"
                  },
                  {
                    "status": "affected",
                    "version": "914"
                  },
                  {
                    "status": "affected",
                    "version": "916"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:700:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A7FED49E-6F9A-494A-9226-1059249960A0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:701:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4836C36D-242F-4818-81B4-C170959D02F5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:702:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A503ABF-8655-40D7-96AD-2D7F19A673AE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:710:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BA008537-4D80-4126-A0D1-B209B9E56B46",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:731:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8A9D5C5A-6963-438B-B0EA-2A621A34D8A9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:740:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BFFA1591-0304-4FAE-A6A7-72D04D1F41A3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:750:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7940A9AF-308E-4CE5-BA19-7A3DCF49F644",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:751:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C09428E4-45BB-414D-9F3D-AA5C73D2DD5E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:752:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5ED0BA7D-939D-4B05-81A3-9F991C8C04F9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:753:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0C2BF545-A7DC-4BB6-B894-D04CF163DD88",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A75B2F18-60BE-41B5-82CB-520F794F2004",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E31620E5-30FC-4545-A430-AAA77A66B51A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9724E131-9893-4630-96A2-EB6032D98C58",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8FEBCDDF-4828-45D1-A81D-FFB50261DBCA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:758:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8FB60751-D53F-496C-AB5B-922561FB27D5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:816:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4E4042A5-8859-44E6-9CA0-AA8A09D081A3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:914:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0018F635-E38F-47AB-9AC3-CA2BBE6D5FA8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:916:*:*:*:*:*:*:*",
                    "matchCriteriaId": "52996086-B7EA-40CB-B6F3-983C11329FF2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application."
          },
          {
            "lang": "es",
            "value": "SAP NetWeaver permite que un usuario no administrativo autenticado acceda al m\u00f3dulo de funci\u00f3n remota, lo que le otorga acceso a informaci\u00f3n no confidencial sobre el sistema SAP y el sistema operativo sin necesidad de conocimientos espec\u00edficos ni condiciones controladas. Esto reduce el impacto en la confidencialidad y no afecta la integridad ni la disponibilidad de la aplicaci\u00f3n."
          }
        ],
        "id": "CVE-2025-42968",
        "lastModified": "2026-06-17T09:23:19.050",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 1.4,
              "source": "cna@sap.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-42968",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T14:29:01.927973Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-07-08T01:15:23.950",
        "references": [
          {
            "source": "cna@sap.com",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://me.sap.com/notes/3621037"
          },
          {
            "source": "cna@sap.com",
            "tags": [
              "Patch"
            ],
            "url": "https://url.sap/sapsecuritypatchday"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-07-10T01:30:32+00:00",
      "cve": "CVE-2025-42968",
      "id": "CVE-2025-42968",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Missing Authorization check in SAP NetWeaver (RFC enabled function module)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-42968.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-42968",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-07-08T14:29:01.927973Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-07-08T14:29:05.128Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAP NetWeaver (RFC enabled function module)",
              "vendor": "SAP_SE",
              "versions": [
                {
                  "status": "affected",
                  "version": "SAP_BW 700"
                },
                {
                  "status": "affected",
                  "version": "701"
                },
                {
                  "status": "affected",
                  "version": "702"
                },
                {
                  "status": "affected",
                  "version": "710"
                },
                {
                  "status": "affected",
                  "version": "731"
                },
                {
                  "status": "affected",
                  "version": "740"
                },
                {
                  "status": "affected",
                  "version": "750"
                },
                {
                  "status": "affected",
                  "version": "751"
                },
                {
                  "status": "affected",
                  "version": "752"
                },
                {
                  "status": "affected",
                  "version": "753"
                },
                {
                  "status": "affected",
                  "version": "754"
                },
                {
                  "status": "affected",
                  "version": "755"
                },
                {
                  "status": "affected",
                  "version": "756"
                },
                {
                  "status": "affected",
                  "version": "757"
                },
                {
                  "status": "affected",
                  "version": "758"
                },
                {
                  "status": "affected",
                  "version": "816"
                },
                {
                  "status": "affected",
                  "version": "914"
                },
                {
                  "status": "affected",
                  "version": "916"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eSAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.\u003c/p\u003e"
                }
              ],
              "value": "SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "eng",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-07-08T00:36:31.953Z",
            "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            "shortName": "sap"
          },
          "references": [
            {
              "url": "https://me.sap.com/notes/3621037"
            },
            {
              "url": "https://url.sap/sapsecuritypatchday"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Missing Authorization check in SAP NetWeaver (RFC enabled function module)",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "assignerShortName": "sap",
        "cveId": "CVE-2025-42968",
        "datePublished": "2025-07-08T00:36:31.953Z",
        "dateReserved": "2025-04-16T13:25:42.158Z",
        "dateUpdated": "2025-07-08T16:13:36.672Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-10654 (CVE-2025-42968)

Vulnerability from fstec – Published: 2025-09-02 – Updated: 2025-09-02 – View on bdu.fstec.ru Fixed

Title

Уязвимость программной интеграционной платформы SAP NetWeaver, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации

Summary

Уязвимость программной интеграционной платформы SAP NetWeaver связана с отсутствием авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, оказать воздействие на конфиденциальность защищаемой информации

Severity

4.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:S/C:P/I:N/A:N

5.0 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-862 - Отсутствие авторизации

Aliases

CVE-2025-42968

References

1 reference

URL
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2…

Impacted products

1 product from 1 vendor

Vendors

SAP

Products

SAP NetWeaver

Versions

SAP_BW 700 (SAP NetWeaver), SAP_BW 701 (SAP NetWeaver), SAP_BW 702 (SAP NetWeaver), SAP_BW 710 (SAP NetWeaver), SAP_BW 731 (SAP NetWeaver), SAP_BW 740 (SAP NetWeaver), SAP_BW 750 (SAP NetWeaver), SAP_BW 751 (SAP NetWeaver), SAP_BW 752 (SAP NetWeaver), SAP_BW 753 (SAP NetWeaver), SAP_BW 754 (SAP NetWeaver), SAP_BW 755 (SAP NetWeaver), SAP_BW 756 (SAP NetWeaver), SAP_BW 757 (SAP NetWeaver), SAP_BW 758 (SAP NetWeaver), SAP_BW 816 (SAP NetWeaver), SAP_BW 914 (SAP NetWeaver), SAP_BW 916 (SAP NetWeaver)

Product types

Network software

Mitigations

Использование рекомендаций: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "SAP",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "SAP_BW 700 (SAP NetWeaver), SAP_BW 701 (SAP NetWeaver), SAP_BW 702 (SAP NetWeaver), SAP_BW 710 (SAP NetWeaver), SAP_BW 731 (SAP NetWeaver), SAP_BW 740 (SAP NetWeaver), SAP_BW 750 (SAP NetWeaver), SAP_BW 751 (SAP NetWeaver), SAP_BW 752 (SAP NetWeaver), SAP_BW 753 (SAP NetWeaver), SAP_BW 754 (SAP NetWeaver), SAP_BW 755 (SAP NetWeaver), SAP_BW 756 (SAP NetWeaver), SAP_BW 757 (SAP NetWeaver), SAP_BW 758 (SAP NetWeaver), SAP_BW 816 (SAP NetWeaver), SAP_BW 914 (SAP NetWeaver), SAP_BW 916 (SAP NetWeaver)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "07.07.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "02.09.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "02.09.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-10654",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-42968",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SAP NetWeaver",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b SAP NetWeaver, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 (CWE-862)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b SAP NetWeaver \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-862",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)"
}

CERTFR-2025-AVI-0564

Vulnerability from certfr_avis - Published: 2025-07-08 - Updated: 2025-07-08

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SAP	NetWeaver	NetWeaver et ABAP Platform (SDCCN) versions ST-PI 2008_1_700, 2008_1_710 et 740
SAP	NetWeaver	NetWeaver Application Server ABAP and ABAP Platform versionsAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758
SAP	Business Objects Business Intelligence Platform	BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025 et 2027
SAP	NetWeaver	NetWeaver Application Server Java version ENGINEAPI 7.50
SAP	NetWeaver	NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816
SAP	Business Warehouse	Business Warehouse and SAP BW/4HANA BEx Tools version DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701
SAP	NetWeaver	NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50
SAP	Business Objects Business Intelligence Platform	Business Objects Business Intelligence Platform (CMC) versions ENTERPRISE 430 et 2025
SAP	NetWeaver	NetWeaver Enterprise Portal Federated Portal Network version EP-RUNTIME 7.50
SAP	NetWeaver	NetWeaver (RFC enabled function module) versions SAP_BW 700, 701, 702, 710, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et 916
SAP	NetWeaver	NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816
SAP	S/4HANA (Private Cloud)	S/4HANA and SAP SCM (Characteristic Propagation) versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, SCM 700, 701, 702 et 712
SAP	N/A	SAPCAR versions SAP_CAR 7.53 et 7.22EXT
SAP	S/4HANA (Private Cloud)	S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758
SAP	NetWeaver	NetWeaver ABAP Server and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 914 et SAP_BASIS 915
SAP	NetWeaver	NetWeaver et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753 et SAP_BASIS 754
SAP	NetWeaver	NetWeaver Application Server for Java (Log Viewer) version LMNWABASICAPPS 7.50
SAP	NetWeaver	NetWeaver (XML Data Archiving Service) version J2EE-APPS 7.50
SAP	Business Objects Business Intelligence Platform	BusinessObjects Content Administrator workbench versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701
SAP	N/A	Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758
SAP	N/A	Data Services (DQ Report) versions SBOP_DS_MANAGEMENT_CONSOLE 4.3 et 2025
SAP	NetWeaver	NetWeaver Visual Composer version VCBASE 7.50
SAP	NetWeaver	NetWeaver Business Warehouse (CCAW application) versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701
SAP	N/A	Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14
SAP	Business Warehouse	Business Warehouse (Business Explorer Web 3.5 loading animation) versions DW4CORE 100, 200, 300, 400, 916, SAP_BW 730, 731, 740, 750, 751, 752, 753, 754, 756, 757 et 758
SAP	NetWeaver	NetWeaver Application Server for ABAP versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816
SAP	Business Objects Business Intelligence Platform	BusinessObjects BI Platform Central Management Console Promotion Management Application versions ENTERPRISE 430, 2025 et 2027
SAP	Business Warehouse	Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816

References

Title

Publication Time

FKIE_CVE-2025-42968

Vulnerability from fkie_nvd - Published: 2025-07-08 01:15 - Updated: 2026-06-17 09:23

Severity

5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	cna@sap.com	https://me.sap.com/notes/3621037	Permissions Required
	cna@sap.com	https://url.sap/sapsecuritypatchday	Patch

Impacted products

Vendor	Product	Version
sap	netweaver	700
sap	netweaver	701
sap	netweaver	702
sap	netweaver	710
sap	netweaver	731
sap	netweaver	740
sap	netweaver	750
sap	netweaver	751
sap	netweaver	752
sap	netweaver	753
sap	netweaver	754
sap	netweaver	755
sap	netweaver	756
sap	netweaver	757
sap	netweaver	758
sap	netweaver	816
sap	netweaver	914
sap	netweaver	916

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver (RFC enabled function module)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BW 700"
            },
            {
              "status": "affected",
              "version": "701"
            },
            {
              "status": "affected",
              "version": "702"
            },
            {
              "status": "affected",
              "version": "710"
            },
            {
              "status": "affected",
              "version": "731"
            },
            {
              "status": "affected",
              "version": "740"
            },
            {
              "status": "affected",
              "version": "750"
            },
            {
              "status": "affected",
              "version": "751"
            },
            {
              "status": "affected",
              "version": "752"
            },
            {
              "status": "affected",
              "version": "753"
            },
            {
              "status": "affected",
              "version": "754"
            },
            {
              "status": "affected",
              "version": "755"
            },
            {
              "status": "affected",
              "version": "756"
            },
            {
              "status": "affected",
              "version": "757"
            },
            {
              "status": "affected",
              "version": "758"
            },
            {
              "status": "affected",
              "version": "816"
            },
            {
              "status": "affected",
              "version": "914"
            },
            {
              "status": "affected",
              "version": "916"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver:700:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7FED49E-6F9A-494A-9226-1059249960A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:701:*:*:*:*:*:*:*",
              "matchCriteriaId": "4836C36D-242F-4818-81B4-C170959D02F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:702:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A503ABF-8655-40D7-96AD-2D7F19A673AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:710:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA008537-4D80-4126-A0D1-B209B9E56B46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:731:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A9D5C5A-6963-438B-B0EA-2A621A34D8A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:740:*:*:*:*:*:*:*",
              "matchCriteriaId": "BFFA1591-0304-4FAE-A6A7-72D04D1F41A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:750:*:*:*:*:*:*:*",
              "matchCriteriaId": "7940A9AF-308E-4CE5-BA19-7A3DCF49F644",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:751:*:*:*:*:*:*:*",
              "matchCriteriaId": "C09428E4-45BB-414D-9F3D-AA5C73D2DD5E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:752:*:*:*:*:*:*:*",
              "matchCriteriaId": "5ED0BA7D-939D-4B05-81A3-9F991C8C04F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:753:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C2BF545-A7DC-4BB6-B894-D04CF163DD88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*",
              "matchCriteriaId": "A75B2F18-60BE-41B5-82CB-520F794F2004",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*",
              "matchCriteriaId": "E31620E5-30FC-4545-A430-AAA77A66B51A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*",
              "matchCriteriaId": "9724E131-9893-4630-96A2-EB6032D98C58",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FEBCDDF-4828-45D1-A81D-FFB50261DBCA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:758:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FB60751-D53F-496C-AB5B-922561FB27D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:816:*:*:*:*:*:*:*",
              "matchCriteriaId": "4E4042A5-8859-44E6-9CA0-AA8A09D081A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:914:*:*:*:*:*:*:*",
              "matchCriteriaId": "0018F635-E38F-47AB-9AC3-CA2BBE6D5FA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:916:*:*:*:*:*:*:*",
              "matchCriteriaId": "52996086-B7EA-40CB-B6F3-983C11329FF2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver permite que un usuario no administrativo autenticado acceda al m\u00f3dulo de funci\u00f3n remota, lo que le otorga acceso a informaci\u00f3n no confidencial sobre el sistema SAP y el sistema operativo sin necesidad de conocimientos espec\u00edficos ni condiciones controladas. Esto reduce el impacto en la confidencialidad y no afecta la integridad ni la disponibilidad de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2025-42968",
  "lastModified": "2026-06-17T09:23:19.050",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "cna@sap.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-42968",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-07-08T14:29:01.927973Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-07-08T01:15:23.950",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://me.sap.com/notes/3621037"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Patch"
      ],
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HV7Q-MJJ7-M8VJ

Vulnerability from github – Published: 2025-07-08 03:31 – Updated: 2025-07-08 03:31

Details

Severity

5.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-42968"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-08T01:15:23Z",
    "severity": "MODERATE"
  },
  "details": "SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.",
  "id": "GHSA-hv7q-mjj7-m8vj",
  "modified": "2025-07-08T03:31:00Z",
  "published": "2025-07-08T03:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42968"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3621037"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2025-0219

Vulnerability from csaf_ncscnl - Published: 2025-07-09 08:29 - Updated: 2025-07-09 08:29

Summary

Kwetsbaarheden verholpen in SAP producten

Scope

27 vulnerabilities in this advisory, including CVE-2025-42968.

CVE-2025-42968

5.0 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Known affected: 160 products

Open the full advisory

VAR-202507-1068

Vulnerability from variot - Updated: 2025-11-18 15:19

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202507-1068",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "757"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "710"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "753"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "816"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "750"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "702"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "754"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "914"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "700"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "755"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "916"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "758"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "701"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "756"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "740"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "752"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "731"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sap",
        "version": "751"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ]
  },
  "cve": "CVE-2025-42968",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "cna@sap.com",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 3.1,
            "id": "CVE-2025-42968",
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2025-42968",
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "cna@sap.com",
            "id": "CVE-2025-42968",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2025-42968",
            "trust": 1.0,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2025-42968"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ],
    "trust": 1.0
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2025-42968",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ]
  },
  "id": "VAR-202507-1068",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.27111164
  },
  "last_update_date": "2025-11-18T15:19:27.920000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-862",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.0,
        "url": "https://url.sap/sapsecuritypatchday"
      },
      {
        "trust": 1.0,
        "url": "https://me.sap.com/notes/3621037"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-07-08T01:15:23.950000",
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-10-27T16:57:45.097000",
        "db": "NVD",
        "id": "CVE-2025-42968"
      }
    ]
  }
}

WID-SEC-W-2025-1479

Vulnerability from csaf_certbund - Published: 2025-07-07 22:00 - Updated: 2025-07-07 22:00

Summary

SAP Patchday Juli 2025: Mehrere Schwachstellen

Severity

Hoch

Scope

36 vulnerabilities in this advisory, including CVE-2025-42968.

CVE-2025-42968

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-42968 (GCVE-0-2025-42968)

BDU:2025-10654 (CVE-2025-42968)

CERTFR-2025-AVI-0564

Solutions

FKIE_CVE-2025-42968

GHSA-HV7Q-MJJ7-M8VJ

NCSC-2025-0219

VAR-202507-1068

WID-SEC-W-2025-1479

Tags

Sightings

Nomenclature

Related by attack behaviour