Improper Memory Address Handling in SAP NetWeaver and ABAP Platform
CVE-2025-30015

4.1MEDIUM

Key Information:

Vendor
SAP
Status
SAP Netweaver And Abap Platform (application Server Abap)
Vendor
CVE Published:
8 April 2025

Summary

An improper memory address handling vulnerability exists in the ABAP SQL of SAP NetWeaver and ABAP Platform. This issue could allow an authenticated attacker with elevated privileges to execute specific SQL queries, potentially leading to unauthorized manipulation of the content in the output variable. Although the impact on confidentiality, integrity, and availability of the application is limited, it underscores the need for ensuring proper memory management to safeguard against potential exploitation.

Affected Version(s)

SAP NetWeaver and ABAP Platform (Application Server ABAP) KRNL64UC 7.53

SAP NetWeaver and ABAP Platform (Application Server ABAP) KERNEL 7.53

SAP NetWeaver and ABAP Platform (Application Server ABAP) 7.54

References

https://me.sap.com/notes/3565944
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.