CVE-2025-23190 — Missing Authorization in SE SAP Netweaver AND Abap Platform

CWE-862 — Missing Authorization3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 77.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
SAP SE SAP Netweaver AND Abap Platform
Timeline
PublishedFeb 11

Description

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶CVEListV5sap_se/sap_netweaver_and_abap_platformST-PI 2008_1_700, ST-PI 2008_1_710, ST-PI 740+2

🔴Vulnerability Details

2
CVEList
Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)↗2025-02-11
▶
GHSA
GHSA-89vf-mf66-frgw: Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they w↗2025-02-11
▶
CVE-2025-23190 — Missing Authorization | cvebase