Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2025-42968

Missing Authorization check in SAP NetWeaver (RFC enabled function module)

Description

SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP NetWeaver (RFC enabled function module)

Default version status: unaffected

  • SAP_BW 700affected
  • 701affected
  • 702affected
  • 710affected
  • 731affected
  • 740affected
  • 750affected
  • 751affected
  • 752affected
  • 753affected
  • 754affected
  • 755affected
  • 756affected
  • 757affected
  • 758affected
  • 816affected
  • 914affected
  • 916affected

References