CVE-2025-23190 MEDIUM

CVE-2025-23190: Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

Vendor Sap_Se
Product SAP NetWeaver and ABAP platform (ST-PI)
Weakness CWE-862 · Missing authorization
Published February 11, 2025
Last update February 11, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.

Key dates

02Disclosure timeline

February 11, 2025 CVE published
February 11, 2025 Record updated