CVEvulnerability

CVE-2025-42936

5.4 MEDIUM Published 2025-08-12 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-08-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-266

Description

The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.

Affected configurations

• sap sap basis 700 • sap sap basis 701 • sap sap basis 702 • sap sap basis 731 • sap sap basis 740 • sap sap basis 750 • sap sap basis 751 • sap sap basis 752 • sap sap basis 753 • sap sap basis 754 • sap sap basis 755 • sap sap basis 756 • sap sap basis 757 • sap sap basis 758 • sap sap basis 816

Related

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References