Unauthorized Read Access in SAP NetWeaver Application Server for ABAP
CVE-2025-42918

4.3MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server For Abap (background Processing)
Vendor
CVE Published:
9 September 2025

What is CVE-2025-42918?

The SAP NetWeaver Application Server for ABAP has a vulnerability that permits authenticated users with background processing access to gain unauthorized read access to sensitive profile parameters. This vulnerability poses a risk to the confidentiality of the system, though it does not compromise integrity or system availability. To mitigate potential risks, SAP encourages users to maintain updated systems and reference regularly published security notes.

Affected Version(s)

SAP NetWeaver Application Server for ABAP (Background Processing) SAP_BASIS 700

SAP NetWeaver Application Server for ABAP (Background Processing) SAP_BASIS 701

SAP NetWeaver Application Server for ABAP (Background Processing) SAP_BASIS 702

References

https://me.sap.com/notes/3623504
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-42918 : Unauthorized Read Access in SAP NetWeaver Application Server for ABAP