« Volver al listado

CVE-2025-42936

Estado: AnalizadaMedia (5.4)—

The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — SAP Basis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-42936",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-42936",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-13T15:03:52.143215Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP NetWeaver Application Server for ABAP",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BASIS 700"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 701"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 702"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 731"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 740"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 750"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 751"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 752"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 753"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 754"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 755"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 756"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 757"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 758"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 816"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-12T03:15:26.477",
  "references": [
    {
      "url": "https://me.sap.com/notes/3602656",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Patch"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-266"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver Application Server para ABAP no permite que un administrador asigne autorizaciones distinguidas a diferentes roles de usuario. Este problema permite que los usuarios autenticados accedan a objetos restringidos en la interfaz de código de barras, lo que provoca una escalada de privilegios. Esto tiene un impacto mínimo en la confidencialidad e integridad de la aplicación y no afecta a la disponibilidad."
    }
  ],
  "lastModified": "2026-06-17T09:23:15.820",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85616273-040E-49CB-8EB6-D2D4D7B603E5"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5F2C3A9-DCC0-4FF1-8E68-9EA150E209F6"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F774A45-2A9F-4873-A5DC-766D030C8CCD"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3A0A2D6-9259-4A35-A236-F4BEE986C1FD"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:740:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49C3A8E5-FA6A-4EF3-BF50-FD4E1576024F"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABA8AB4E-3FE6-46A8-847E-660C5DF6CE71"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:751:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DA4A6F0-C0F1-42CB-8BBD-7198064733EA"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C121CC9-26F6-4103-8EB0-BAFF6B5B5FE8"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86086D00-10BF-4C55-8D87-82CCBE468153"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F25246A-D9E5-4F0D-B91A-478D4E5570DB"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0218695F-C4AD-46BF-B176-F10C644A9C2D"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC9E7C3E-1005-450A-9198-E014C1BAADBC"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A177AB1-CC85-46EF-91DF-462096608C9F"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7591F81-708C-4285-9BB2-F2B4BDB9759B"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:816:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF7825FC-2F0F-4096-BE41-67B4DCC4F7DE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}