Authorization Bypass in SAP NetWeaver Application Server for ABAP
CVE-2025-42882

4.3MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server For Abap
Vendor
CVE Published:
11 November 2025

What is CVE-2025-42882?

A vulnerability exists in SAP NetWeaver Application Server for ABAP, where an authenticated attacker with basic privileges can exploit a missing authorization check. By executing a specific function module, the attacker could retrieve sensitive technical information from the system. This exposure of environment details may facilitate further malicious actions, highlighting the importance of robust security measures to protect sensitive data.

Affected Version(s)

SAP NetWeaver Application Server for ABAP SAP_BASIS 700

SAP NetWeaver Application Server for ABAP SAP_BASIS 701

SAP NetWeaver Application Server for ABAP SAP_BASIS 702

References

https://me.sap.com/notes/3643337
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-42882 : Authorization Bypass in SAP NetWeaver Application Server for ABAP