FKIE_CVE-2025-0063

Vulnerability from fkie_nvd - Published: 2025-01-14 01:15 - Updated: 2025-10-24 19:11
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.
References
cna@sap.comhttps://me.sap.com/notes/3550816Permissions Required
cna@sap.comhttps://url.sap/sapsecuritypatchdayPatch
Impacted products
Vendor Product Version
sap sap_basis 700
sap sap_basis 701
sap sap_basis 702
sap sap_basis 731
sap sap_basis 740
sap sap_basis 750
sap sap_basis 751
sap sap_basis 752
sap sap_basis 753
sap sap_basis 754
sap sap_basis 755
sap sap_basis 756
sap sap_basis 757
sap sap_basis 758
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:700:*:*:*:*:*:*:*",
              "matchCriteriaId": "85616273-040E-49CB-8EB6-D2D4D7B603E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:701:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5F2C3A9-DCC0-4FF1-8E68-9EA150E209F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:702:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F774A45-2A9F-4873-A5DC-766D030C8CCD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:731:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3A0A2D6-9259-4A35-A236-F4BEE986C1FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:740:*:*:*:*:*:*:*",
              "matchCriteriaId": "49C3A8E5-FA6A-4EF3-BF50-FD4E1576024F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:750:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABA8AB4E-3FE6-46A8-847E-660C5DF6CE71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:751:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DA4A6F0-C0F1-42CB-8BBD-7198064733EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C121CC9-26F6-4103-8EB0-BAFF6B5B5FE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*",
              "matchCriteriaId": "86086D00-10BF-4C55-8D87-82CCBE468153",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F25246A-D9E5-4F0D-B91A-478D4E5570DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:*",
              "matchCriteriaId": "0218695F-C4AD-46BF-B176-F10C644A9C2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC9E7C3E-1005-450A-9198-E014C1BAADBC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A177AB1-CC85-46EF-91DF-462096608C9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7591F81-708C-4285-9BB2-F2B4BDB9759B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver AS ABAP y ABAP Platform no comprueban la autorizaci\u00f3n cuando un usuario ejecuta algunos m\u00f3dulos de funciones RFC. Esto podr\u00eda llevar a un atacante con privilegios de usuario b\u00e1sicos a obtener el control de los datos en la base de datos Informix, lo que provocar\u00eda un compromiso total de la confidencialidad, la integridad y la disponibilidad."
    }
  ],
  "id": "CVE-2025-0063",
  "lastModified": "2025-10-24T19:11:48.830",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-14T01:15:16.633",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://me.sap.com/notes/3550816"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Patch"
      ],
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "cna@sap.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.