CVE-2025-27428: Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)
First published: Tue Apr 08 2025(Updated: )
Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon successful exploitation, they could read files from any managed system connected to SAP Solution Manager, leading to high impact on confidentiality. There is no impact on integrity or availability.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver | ||
| SAP ABAP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-27428?
CVE-2025-27428 has a high severity rating due to its potential to allow unauthorized access to critical information.
How do I fix CVE-2025-27428?
To fix CVE-2025-27428, apply the latest security patches provided by SAP for the affected versions of SAP NetWeaver and SAP ABAP Platform.
Who is affected by CVE-2025-27428?
CVE-2025-27428 affects users of SAP NetWeaver and SAP ABAP Platform that utilize the RFC enabled function module.
What kind of information can be exposed by exploiting CVE-2025-27428?
Exploiting CVE-2025-27428 can allow unauthorized attackers to read sensitive files from any managed system connected to SAP Solution Manager.
What is a directory traversal vulnerability in the context of CVE-2025-27428?
A directory traversal vulnerability, as seen in CVE-2025-27428, allows attackers to access system files and directories that are outside the intended file paths.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/sap
- canonical/sap netweaver
- canonical/sap abap