CVE-2025-0067: Missing Authorization check in SAP NetWeaver Application Server Java
First published: Tue Jan 14 2025(Updated: )
Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver AS for Java |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-0067?
CVE-2025-0067 has a low impact severity level due to the nature of the vulnerability allowing unauthorized creation of JCo connection entries.
How do I fix CVE-2025-0067?
To fix CVE-2025-0067, implement proper authorization checks on the service endpoints within the SAP NetWeaver Application Server Java.
Which versions of SAP NetWeaver Application Server Java are affected by CVE-2025-0067?
CVE-2025-0067 affects all versions of SAP NetWeaver Application Server Java that lack the necessary authorization checks.
What could an attacker do with CVE-2025-0067?
An attacker exploiting CVE-2025-0067 could create unauthorized JCo connection entries, allowing them to make remote function calls.
Is there a patch available for CVE-2025-0067?
Yes, SAP provides updates and patches to address CVE-2025-0067; users should refer to SAP's security notes for specific instructions.
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/weakness
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/sap
- canonical/sap netweaver as for java