Vulnerability · Published Apr 8, 2025 · Assigned by sap

CVE-2025-30015Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Medium 4.1

In plain English

A medium-severity out-of-bounds write in SAP NetWeaver and ABAP Platform (Application Server ABAP) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium

Exploit odds (30 days)0.3%top 80.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output variable. This vulnerability has a low impact on the confidentiality, integrity and the availability of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP NetWeaver and ABAP Platform (Application Server ABAP)	KRNL64UC 7.53KERNEL 7.537.54

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References