CVE-2025-27437 — Missing Authorization in SE SAP Netweaver Application Server Abap

CWE-862 — Missing Authorization4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 63.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
SAP SE SAP Netweaver Application Server Abap
Timeline
PublishedApr 8

Description

A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate a transaction, allowing them to access but not modify non-sensitive data without further authorization and with no effect on availability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

🔴Vulnerability Details

2
CVEList
Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface)↗2025-04-08
▶
GHSA
GHSA-vr7x-83h2-6m7q: A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP↗2025-04-08
▶

📋Vendor Advisories

1
Microsoft
vfio/pci: Disable auto-enable of exclusive INTx IRQ↗2024-04-09
▶
CVE-2025-27437 — Missing Authorization | cvebase