CVE-2025-23190: Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)
Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23190?
CVE-2025-23190 is classified as a medium severity vulnerability due to the potential unauthorized data access.
How do I fix CVE-2025-23190?
To fix CVE-2025-23190, ensure that proper authorization checks are implemented for the affected function modules.
Who is affected by CVE-2025-23190?
CVE-2025-23190 affects users of SAP NetWeaver and SAP ABAP platform (ST-PI) who have authenticated access.
What can an attacker do in CVE-2025-23190?
An attacker exploiting CVE-2025-23190 can access sensitive data through remote-enabled function modules without authorization.
Is it possible for an attacker to modify data with CVE-2025-23190?
No, an attacker cannot modify data or impact system availability with CVE-2025-23190.