CVE-2025-42974

Description

Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information normally restricted, resulting in low impact on confidentiality. There is no impact on integrity or availability.

Reserved 2025-04-16 | Published 2025-07-08 | Updated 2025-07-08 | Assigner sap

Problem types

CWE-862: Missing Authorization

Product status

Default status
unaffected

ST-PI 2008_1_700
affected

2008_1_710
affected

740
affected

References

me.sap.com/notes/3610056

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42974)

nvd.nist.gov (CVE-2025-42974)

Download JSON