CVE-2025-24872: Missing Authorization check in SAP ABAP Platform (ABAP Build Framework)
The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact on the confidentiality of the application with no effect on the integrity and availability of the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24872?
CVE-2025-24872 has been rated as a medium severity vulnerability.
How do I fix CVE-2025-24872?
To address CVE-2025-24872, ensure that your SAP ABAP Platform is updated to the latest security patches provided by SAP.
Who is affected by CVE-2025-24872?
CVE-2025-24872 affects users of the SAP ABAP Platform who have access to the ABAP Build Framework.
What are the potential risks of CVE-2025-24872?
An attacker exploiting CVE-2025-24872 could gain unauthorized access to sensitive transaction details.
Is there a workaround for CVE-2025-24872?
Currently, SAP recommends applying the security update as the primary method to mitigate the effects of CVE-2025-24872.