CVE-2025-23193: Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP

Published Feb 11, 2025

Updated

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server availability.

Affected Software

15 affected components

SAP NetWeaver Application Server ABAP

SAP SAP BASIS=700

SAP SAP BASIS=701

SAP SAP BASIS=702

SAP SAP BASIS=731

SAP SAP BASIS=740

SAP SAP BASIS=750

SAP SAP BASIS=751

SAP SAP BASIS=752

SAP SAP BASIS=753

SAP SAP BASIS=754

SAP SAP BASIS=755

SAP SAP BASIS=756

SAP SAP BASIS=757

SAP SAP BASIS=758

Remediation

Patch Available

https://url.sap/sapsecuritypatchday

Event History

Feb 11, 2025

CVE Published

via MITRE·12:35 AM

Data Sourced

via MITRE·12:35 AM

DescriptionSeverity

Data Sourced

via NVD·01:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-23193?

CVE-2025-23193 is considered a medium severity vulnerability due to its potential to expose sensitive information.

How do I fix CVE-2025-23193?

To fix CVE-2025-23193, ensure that you apply the latest security patches released by SAP for the NetWeaver Application Server ABAP.

Who is affected by CVE-2025-23193?

CVE-2025-23193 affects users of SAP NetWeaver Application Server ABAP without proper security configurations.

Can CVE-2025-23193 result in data modification?

No, CVE-2025-23193 does not allow for data modification, but it can lead to information disclosure.

What actions can be taken to mitigate CVE-2025-23193?

To mitigate CVE-2025-23193, review your user access controls and monitor network traffic for unusual activity.