Vulnerability · Published Aug 12, 2025 · Assigned by sap
CVE-2025-42949Missing Authorization check in ABAP Platform
Medium 4.9
In plain English
A medium-severity missing authorization in ABAP Platform from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Official description
Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | ABAP Platform | SAP_BASIS 758SAP_BASIS 816SAP_BASIS 916 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N