Privilege Escalation in SAP NetWeaver Application Server for ABAP
CVE-2025-42936

5.4MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server For Abap
Vendor
CVE Published:
12 August 2025

What is CVE-2025-42936?

The SAP NetWeaver Application Server for ABAP contains a vulnerability that permits authenticated users to access restricted objects within the barcode interface due to improper authorization management for user roles. This oversight allows for an escalation of privileges beyond the intended access levels, potentially compromising the confidentiality and integrity of the application. Proper role assignment and rigorous access controls are critical to mitigate these risks.

Affected Version(s)

SAP NetWeaver Application Server for ABAP SAP_BASIS 700

SAP NetWeaver Application Server for ABAP SAP_BASIS 701

SAP NetWeaver Application Server for ABAP SAP_BASIS 702

References

https://me.sap.com/notes/3602656
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-42936 : Privilege Escalation in SAP NetWeaver Application Server for ABAP