CVE-2025-42891CWE-862broken-access-control

CVE-2025-42891

Medium · published December 9, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data integrity. There is no impact on application's availability.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-09T21:17Z
References (2)
https://me.sap.com/notes/3659117 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 09 DEC 02:15Z
    Missing Authorization check in SAP Enterprise Search for ABAP
    cvelistv5