« Volver al listado

CVE-2025-42986

Estado: AnalizadaMedia (4.3)—

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — SAP Basis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-42986",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-42986",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-08T18:11:27.468016Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP NetWeaver and ABAP Platform",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BASIS 700"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 701"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 702"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 731"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 740"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 750"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 751"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 752"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 753"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 754"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-08T01:15:25.730",
  "references": [
    {
      "url": "https://me.sap.com/notes/3626440",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Patch"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application."
    },
    {
      "lang": "es",
      "value": "Debido a la falta de una verificación de autorización en un módulo de función obsoleto habilitado para RFC en SAP BASIS, un atacante autenticado con pocos privilegios podría ejecutar una Llamada a Función Remota (RFC), lo que podría permitir el acceso a información restringida del sistema. Esto genera un impacto mínimo en la confidencialidad, sin afectar la integridad ni la disponibilidad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T09:23:20.730",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85616273-040E-49CB-8EB6-D2D4D7B603E5"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5F2C3A9-DCC0-4FF1-8E68-9EA150E209F6"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F774A45-2A9F-4873-A5DC-766D030C8CCD"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3A0A2D6-9259-4A35-A236-F4BEE986C1FD"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:740:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49C3A8E5-FA6A-4EF3-BF50-FD4E1576024F"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABA8AB4E-3FE6-46A8-847E-660C5DF6CE71"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:751:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DA4A6F0-C0F1-42CB-8BBD-7198064733EA"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C121CC9-26F6-4103-8EB0-BAFF6B5B5FE8"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86086D00-10BF-4C55-8D87-82CCBE468153"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F25246A-D9E5-4F0D-B91A-478D4E5570DB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}