CVE-2025-42882: sap_se sap netweaver application server for abap Missing Authorization

Vulnerability summary

CVE-2025-42882 is a medium (CVSS 4.3) Missing Authorization vulnerability in sap_se sap netweaver application server for abap. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.6% of scored vulnerabilities.

Timeline

1. 11-11-2025
   PublishedVulnerability first disclosed.
2. 12-11-2025
   Last modifiedVulnerability information updated.

Description

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact on confidentiality, with no impact on the integrity or availability of the application.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.