CVE-2025-0063

8.8 HIGH
Published: January 14, 2025 Modified: October 24, 2025

Description

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://me.sap.com/notes/3550816
Source: cna@sap.com
Permissions Required
https://url.sap/sapsecuritypatchday
Source: cna@sap.com
Patch

2 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.8 / 10.0
EPSS (Exploit Probability)
0.3%
53th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

Affected Vendors

sap