CVE-2025-27437

Description

A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate a transaction, allowing them to access but not modify non-sensitive data without further authorization and with no effect on availability.

Reserved 2025-02-25 | Published 2025-04-08 | Updated 2025-04-08 | Assigner sap

Problem types

CWE-862: Missing Authorization

Product status

Default status
unaffected

SAP_BASIS 700
affected

SAP_BASIS 701
affected

SAP_BASIS 702
affected

SAP_BASIS 731
affected

SAP_BASIS 740
affected

SAP_BASIS 750
affected

SAP_BASIS 751
affected

SAP_BASIS 752
affected

SAP_BASIS 753
affected

SAP_BASIS 754
affected

SAP_BASIS 755
affected

SAP_BASIS 756
affected

SAP_BASIS 757
affected

SAP_BASIS 758
affected

References

me.sap.com/notes/3568778

url.sap/sapsecuritypatchday

cve.org (CVE-2025-27437)

nvd.nist.gov (CVE-2025-27437)

Download JSON