CVE-2025-42968

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-42968
SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3621037 Permissions Required
https://url.sap/sapsecuritypatchday Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:netweaver:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:753:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:758:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:816:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:914:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:916:*:*:*:*:*:*:*
History

27 Oct 2025, 16:57

Type Values Removed Values Added
References () https://me.sap.com/notes/3621037 - () https://me.sap.com/notes/3621037 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Patch
CPE cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:753:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:916:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:816:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:758:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver:914:*:*:*:*:*:*:*
First Time Sap netweaver
Sap

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) SAP NetWeaver permite que un usuario no administrativo autenticado acceda al módulo de función remota, lo que le otorga acceso a información no confidencial sobre el sistema SAP y el sistema operativo sin necesidad de conocimientos específicos ni condiciones controladas. Esto reduce el impacto en la confidencialidad y no afecta la integridad ni la disponibilidad de la aplicación.

08 Jul 2025, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-08 01:15

Updated : 2025-10-27 16:57

NVD link : CVE-2025-42968

Mitre link : CVE-2025-42968

CVE.ORG link : CVE-2025-42968

JSON object : View

Products Affected

sap

  • netweaver
CWE
CWE-862

Missing Authorization