Vulnerability · Published May 13, 2025 · Assigned by sap
CVE-2025-42997Information Disclosure vulnerability in SAP Gateway Client
Medium 6.6
In plain English
A medium-severity incorrect permission assignment in SAP Gateway Client from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Gateway Client | SAP_GWFND 752753754755756757758 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L