Vulnerability · Published Aug 12, 2025 · Assigned by sap

CVE-2025-42955Missing authorization check in SAP Cloud Connector

Low 3.5

In plain English

A low-severity missing authorization in SAP Cloud Connector from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted request to the endpoint responsible for testing LDAP connections. A successful exploit could lead to reduced performance, hence a low-impact on availability of the service. Confidentiality and integrity of the data are not affected.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Cloud Connector	SAP_CLOUD_CONNECTOR 2.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

In plain English

Official description

Affected products (as reported)

References