CVE-2025-0066 | Under certain conditions SAP NetWeaver AS for ABAP and ABAP … | CVSS 9.9 CRITICAL

Description

Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application

Metadata

CVE ID: CVE-2025-0066
State: PUBLISHED
Assigner: sap
Reserved: 2024-12-11 05:05 UTC
Published: 2025-01-14 00:09 UTC
Last updated: 2025-01-14 14:50 UTC
Primary CWE: CWE-732
CWE-732: Incorrect Permission Assignment for Critical Resour…
Vendor / Product: SAP_SE / SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
SAP_SE	SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)	—	SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731 …

Weakness (CWE)

CWE	Source	Description
CWE-732	cna	CWE-732: Incorrect Permission Assignment for Critical Resource

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)