Riskcovery

CVE-2025-0059

Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

State
Published
Severity
6.0 Medium
Published
Jan 14, 2025
Updated
Jan 14, 2025
Reserved
Dec 5, 2024

Read the record on cve.org

Description

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.

Scores

CVSSScoreVectorSource
3.16.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:Nsap

Weaknesses

  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected Products

ProductVersions
SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)SAP_SE
  • KRNL64UC 7.53Affected
  • KERNEL 7.53Affected
  • 7.54Affected
  • 7.77Affected
  • 7.89Affected
  • 7.93Affected
  • 9.12Affected
  • 9.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.