Vulnerability · Published Jan 14, 2025 · Assigned by sap
CVE-2025-0063SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
High 8.8
In plain English
A high-severity SQL injection in SAP NetWeaver AS ABAP and ABAP Platform from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 45.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 700SAP_BASIS 701SAP_BASIS 702SAP_BASIS 731SAP_BASIS 740SAP_BASIS 750SAP_BASIS 751SAP_BASIS 752 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H