Missing Authorization check in SAP Enterprise Search for ABAP (SAP_SE SAP Enterprise Search for ABAP)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.31 % · percentile 24 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Deferred
Description
Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data integrity. There is no impact on application's availability.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N | sap |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-201847
- GCVE · GCVE-0-2025-42891
CERT-FR advisories
- CERTFR-2025-AVI-1079 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Enterprise Search for ABAP | affected SAP_BASIS 752 ; affected SAP_BASIS 753 ; affected SAP_BASIS 754 ; affected SAP_BASIS 755 ; affected SAP_BASIS 756 ; affected SAP_BASIS 757 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |