CVE-2025-42974

Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information normally restricted, resulting in low impact on confidentiality. There is no impact on integrity or availability.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - cna@sap.com

Published

2025-07-08

Last modified

2025-07-08

Weaknesses

CWE-862

Affected products

• Sap Netweaver And Abap Platform Sdccn (Sap Se)

References

• https://me.sap.com/notes/3610056
• https://url.sap/sapsecuritypatchday