Riskcovery

CVE-2025-0071

Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager

State
Published
Severity
4.9 Medium
Published
Mar 11, 2025
Updated
Mar 11, 2025
Reserved
Dec 11, 2024

Read the record on cve.org

Description

SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impact on integrity or availability.

Scores

CVSSScoreVectorSource
3.14.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Nsap

Weaknesses

  • CWE-532 Insertion of Sensitive Information into Log File

Affected Products

ProductVersions
SAP Web Dispatcher and Internet Communication ManagerSAP_SE
  • KRNL64UC 7.53Affected
  • WEBDISP 7.53Affected
  • 7.54Affected
  • 7.77Affected
  • 7.89Affected
  • 7.93Affected
  • KERNEL 7.53Affected
  • 9.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.