Riskcovery

CVE-2025-42952

Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis

State
Published
Severity
7.7 High
Published
Jul 8, 2025
Updated
Jul 8, 2025
Reserved
Apr 16, 2025

Read the record on cve.org

Description

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially rendering the system unusable. On successful exploitation, an attacker can render the system unusable by triggering short dumps on login. This could cause a high impact on availability. Data confidentiality and integrity are not affected. No data can be read, changed or deleted.

Scores

CVSSScoreVectorSource
3.17.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsap

Weaknesses

Affected Products

ProductVersions
SAP Business Warehouse and SAP Plug-In BasisSAP_SE
  • PI_BASIS 2006_1_700Affected
  • 701Affected
  • 702Affected
  • 731Affected
  • 740Affected
  • SAP_BW 700Affected
  • 750Affected
  • 751Affected
  • 752Affected
  • 753Affected
  • 754Affected
  • 755Affected
  • 756Affected
  • 757Affected
  • 758Affected
  • 816Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.