CVE-2025-42949

Description

Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.

Reserved 2025-04-16 | Published 2025-08-12 | Updated 2025-08-12 | Assigner sap

Problem types

CWE-862: Missing Authorization

Product status

Default status
unaffected

SAP_BASIS 758
affected

SAP_BASIS 816
affected

SAP_BASIS 916
affected

References

me.sap.com/notes/3626722

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42949)

nvd.nist.gov (CVE-2025-42949)

Download JSON