CVE-2025-27428 — Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)

CVE-2025-27428

Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) PUBLISHED

Description (CNA)

Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon successful exploitation, they could read files from any managed system connected to SAP Solution Manager, leading to high impact on confidentiality. There is no impact on integrity or availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver and ABAP Platform (Service Data Collection)	affected ST-PI 2008_1_700; affected 2008_1_710; affected 740

CWE

CWE-862

References

https://me.sap.com/notes/3581811
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.