CVE-2025-42949
Missing Authorization check in ABAP Platform
- State
- Published
- Severity
- 4.9 Medium
- Published
- Aug 12, 2025
- Updated
- Aug 13, 2025
- Reserved
- Apr 16, 2025
Description
Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | sap |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
ABAP PlatformSAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.