Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow (SAP_SE SAP Business Workflow and SAP Flexible Workflow)
En bref
- Source
- NVD
- EPSS
- EPSS 0.34 % · centile 28 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Analyzed
Description
In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.
Faiblesses (CWE)
- CWE-639 — Contournement d'autorisation par clé contrôlée par l'utilisateur (IDOR)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | sap |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-1488
- GCVE · GCVE-0-2025-0058
Avis du CERT-FR
- CERTFR-2025-AVI-0027 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:*cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:*cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:*cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:*cpe:2.3:a:sap:sap_basis:912:*:*:*:*:*:*:*cpe:2.3:a:sap:sap_basis:913:*:*:*:*:*:*:*cpe:2.3:a:sap:sap_basis:914:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP Business Workflow and SAP Flexible Workflow | affected SAP_BASIS 753 ; affected SAP_BASIS 754 ; affected SAP_BASIS 755 ; affected SAP_BASIS 756 ; affected SAP_BASIS 757 ; affected SAP_BASIS 758 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |