CVE-2025-0067: Missing Authorization check in SAP NetWeaver Application Server Java
Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0067?
CVE-2025-0067 has a low impact severity level due to the nature of the vulnerability allowing unauthorized creation of JCo connection entries.
How do I fix CVE-2025-0067?
To fix CVE-2025-0067, implement proper authorization checks on the service endpoints within the SAP NetWeaver Application Server Java.
Which versions of SAP NetWeaver Application Server Java are affected by CVE-2025-0067?
CVE-2025-0067 affects all versions of SAP NetWeaver Application Server Java that lack the necessary authorization checks.
What could an attacker do with CVE-2025-0067?
An attacker exploiting CVE-2025-0067 could create unauthorized JCo connection entries, allowing them to make remote function calls.
Is there a patch available for CVE-2025-0067?
Yes, SAP provides updates and patches to address CVE-2025-0067; users should refer to SAP's security notes for specific instructions.