CVE-2025-0066CWE-732

Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)

Critical · published January 14, 2025

CVSS v3.1
9.9
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

🚨 Weak access controls in SAP NetWeaver could allow unauthorized access to sensitive information — a nightmare for any organization! 🔥 Think of it like a hotel with a faulty security system that lets anyone wander into the VIP lounge — all it takes is one wrong click to be granted access to the most exclusive rooms. An attacker could exploit this vulnerability to access restricted data, compromising the confidentiality, integrity, and availability of critical applications. This could lead to severe data breaches, loss of user trust, or even regulatory penalties — absolutely devastating for any business!

Put simply

Think of it like a hotel with a faulty security system that lets anyone wander into the VIP lounge — all it takes is one wrong click to be granted access to the most exclusive rooms. This vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform occurs when weak access controls allow unauthorized users to access restricted information, potentially exposing sensitive data and system functions.

What to do

An attacker could exploit this vulnerability to access restricted data, compromising the confidentiality, integrity, and availability of critical applications. This could lead to severe data breaches, loss of user trust, or even regulatory penalties — absolutely devastating for any business! To protect against this exploit, patch your systems immediately to the latest version provided by SAP. Review your access controls and ensure they are properly enforced to safeguard sensitive information. Regular audits can help identify any additional vulnerabilities. 🛡️ You've got this! Follow these steps, and you'll be on the road to securing your systems in no time! 💪✨

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-01-14T00:09Z
EPSS history
Timeline
  • 14 JAN 00:09Z
    Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
    cvelistv5