{"id":"CVE-2025-42953","aliases":["EUVD-2025-20352","GHSA-h6h7-jgvg-jrhf"],"status":"published","title":"Missing Authorization check in SAP NetWeaver Application Server for ABAP","description":"SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00492,"percentile":0.42593,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-07-08T00:34:41Z","modified":"2026-11-03T22:03:01Z","products":[{"vendor":"sap_se","product":"sap netweaver application server for abap"}],"references":[{"url":"https://me.sap.com/notes/3623440"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-42953"},{"url":"https://github.com/advisories/GHSA-h6h7-jgvg-jrhf"}],"sources":{"cve":[{"id":"CVE-2025-42953","title":"Missing Authorization check in SAP NetWeaver Application Server for ABAP","description":"SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system.","status":"published","published":"2025-07-08T00:34:41.326Z","modified":"2026-11-03T22:03:01.868Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-03T23:33:08.294318Z"}],"euvd":[{"id":"EUVD-2025-20352","description":"SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system.","status":"published","published":"2025-07-08T00:34:41Z","modified":"2026-11-03T22:03:01Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T23:01:35.361827Z"}],"ghsa":[{"id":"GHSA-h6h7-jgvg-jrhf","title":"SAP Netweaver System Configuration does not perform necessary authorization checks for an...","description":"SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system.","status":"published","published":"2025-07-08T03:30:59Z","modified":"2025-07-08T03:31:02Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:02:56.056966Z"}],"nvd":[{"id":"CVE-2025-42953","description":"SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system.","status":"published","published":"2025-07-08T01:15:22.163Z","modified":"2026-06-17T09:23:17.47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:16.997062Z"}]}}