CVE-2025-24869: Information Disclosure vulnerability in SAP NetWeaver Application Server Java
First published: Tue Feb 11 2025(Updated: )
SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver AS JAVA |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-24869?
CVE-2025-24869 has been rated as a medium severity vulnerability.
How do I fix CVE-2025-24869?
To fix CVE-2025-24869, it is recommended to apply the latest security patches provided by SAP for the NetWeaver Application Server Java.
What type of information is exposed by CVE-2025-24869?
CVE-2025-24869 can expose information about deployed server components, including their XML definitions.
Who is affected by CVE-2025-24869?
CVE-2025-24869 affects users of the SAP NetWeaver Application Server Java.
Is there a workaround for CVE-2025-24869?
Currently, no specific workarounds are advised for CVE-2025-24869 other than applying the appropriate SAP patches.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/references
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/severity
- agent/weakness
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/sap
- canonical/sap netweaver as java