CVE-2025-23187: Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)
Published Feb 11, 2025
·Updated
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability.
Affected Software
2 affected components
SAP NetWeaver
SAP ABAP Platform
Event History
Feb 11, 2025
CVE Published
via MITRE·12:33 AM
Data Sourced
via MITRE·12:33 AM
DescriptionSeverity
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeakness
Nov 30, 57087
Event
via FIRST·10:52 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-23187?
CVE-2025-23187 has a low impact on integrity but does not affect confidentiality or availability.
2
How do I fix CVE-2025-23187?
To mitigate CVE-2025-23187, ensure proper authorization checks are implemented in the relevant RFC-enabled function modules.
3
Which software is affected by CVE-2025-23187?
CVE-2025-23187 affects SAP NetWeaver and SAP ABAP Platform.
4
What type of attack does CVE-2025-23187 allow?
CVE-2025-23187 allows an unauthenticated attacker to generate technical meta-data due to missing authorization checks.
5
What function module is involved in CVE-2025-23187?
The vulnerability exists in an RFC-enabled function module within transaction SDCCN.