CVE-2025-0058

Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow

State: Published
Severity: 6.5 Medium
Published: Jan 14, 2025
Updated: Jan 14, 2025
Reserved: Dec 5, 2024

Description

In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	sap

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
SAP Business Workflow and SAP Flexible WorkflowSAP_SE	SAP_BASIS 753Affected SAP_BASIS 754Affected SAP_BASIS 755Affected SAP_BASIS 756Affected SAP_BASIS 757Affected SAP_BASIS 758Affected SAP_BASIS 912Affected SAP_BASIS 913Affected SAP_BASIS 914Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.