CVE-2025-42949 — Missing Authorization check in ABAP Platform

CVE-2025-42949

Missing Authorization check in ABAP Platform PUBLISHED

Description (CNA)

Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.

Affected (CNA)

Vendor / product	Versions
SAP_SE / ABAP Platform	affected SAP_BASIS 758; affected SAP_BASIS 816; affected SAP_BASIS 916

CWE

CWE-862

References

https://me.sap.com/notes/3626722
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.