CVE-2025-42974 MEDIUM

CVE-2025-42974: Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Vendor Sap_Se
Product SAP NetWeaver and ABAP Platform (SDCCN)
Weakness CWE-862 · Missing authorization
Published July 8, 2025
Last update July 8, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information normally restricted, resulting in low impact on confidentiality. There is no impact on integrity or availability.

Key dates

02Disclosure timeline

July 8, 2025 CVE published
July 8, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-58168 DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users CVE-2026-11773 Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification CVE-2026-3462 Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification CVE-2026-12122 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action CVE-2026-57731 WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability