CVE-2025-23190

Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

State: Published
Severity: 4.3 Medium
Published: Feb 11, 2025
Updated: Feb 11, 2025
Reserved: Jan 13, 2025

Description

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	sap

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
SAP NetWeaver and ABAP platform (ST-PI)SAP_SE	ST-PI 2008_1_700Affected ST-PI 2008_1_710Affected ST-PI 740Affected

References

https://me.sap.com/notes/3547581
https://url.sap/sapsecuritypatchday

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.