CVE-2025-30015: Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
First published: Tue Apr 08 2025(Updated: )
Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output variable. This vulnerability has a low impact on the confidentiality, integrity and the availability of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver | ||
| SAP ABAP | ||
| SAP Application Server ABAP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-30015?
CVE-2025-30015 is classified as a high severity vulnerability due to the potential for unauthorized SQL manipulation.
How do I fix CVE-2025-30015?
To fix CVE-2025-30015, apply the latest security patches available from SAP for affected products.
What are the affected products for CVE-2025-30015?
Affected products for CVE-2025-30015 include SAP NetWeaver, SAP ABAP Platform, and SAP Application Server ABAP.
What kind of exploitation is possible with CVE-2025-30015?
Exploitation of CVE-2025-30015 allows authenticated attackers to execute specific SQL queries, potentially manipulating output variables.
Who is at risk from CVE-2025-30015?
Organizations using the affected SAP products with high privileged accounts are at risk from CVE-2025-30015.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/sap
- canonical/sap netweaver
- canonical/sap abap
- canonical/sap application server abap