{"id":"CVE-2025-0068","aliases":["EUVD-2025-1497","GHSA-9mqg-4jv7-4m83"],"status":"published","title":"Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP","description":"An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00278,"percentile":0.20436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-01-14T00:09:52Z","modified":"2026-06-17T08:25:45Z","products":[{"vendor":"sap_se","product":"sap netweaver application server abap"}],"references":[{"url":"https://me.sap.com/notes/3550674"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0068"},{"url":"https://github.com/advisories/GHSA-9mqg-4jv7-4m83"}],"sources":{"cve":[{"id":"CVE-2025-0068","title":"Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP","description":"An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.","status":"published","published":"2025-01-14T00:09:52.994Z","modified":"2025-01-14T15:03:46.979Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:53.81273Z"}],"euvd":[{"id":"EUVD-2025-1497","description":"An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.","status":"published","published":"2025-01-14T00:09:52Z","modified":"2025-01-14T15:03:46Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:20.377491Z"}],"ghsa":[{"id":"GHSA-9mqg-4jv7-4m83","title":"An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary...","description":"An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.","status":"published","published":"2025-01-14T03:31:42Z","modified":"2025-01-14T03:31:48Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:59:29.015568Z"}],"nvd":[{"id":"CVE-2025-0068","description":"An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.","status":"published","published":"2025-01-14T01:15:17.107Z","modified":"2026-06-17T08:25:45.007Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:48.373347Z"}]}}