Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM) (SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM))
En bref
- Source
- NVD
- EPSS
- EPSS 0.36 % · centile 30 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Deferred
Rechercher sur…
Description
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.
Faiblesses (CWE)
- CWE-1244 — Internal Asset Exposed to Unsafe Debug Access Level or State
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H | sap |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-201849
- GCVE · GCVE-0-2025-42878
Avis du CERT-FR
- CERTFR-2025-AVI-1079 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP Web Dispatcher and Internet Communication Manager (ICM) | affected KRNL64NUC 7.22 ; affected 7.22EXT ; affected KRNL64UC 7.22 ; affected 7.53 ; affected WEBDISP 7.22_EXT ; affected 7.54 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |