Missing Authentication check in SAP NetWeaver Internet Communication Framework (SAP_SE SAP NetWeaver Internet Communication Framework)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.34 % · percentile 28 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Deferred
Description
The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.
Weaknesses (CWE)
- CWE-306 — Missing Authentication for Critical Functionality
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.6 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L | sap |
| CVSS 3.1 | MEDIUM 6.6 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-201852
- GCVE · GCVE-0-2025-42875
CERT-FR advisories
- CERTFR-2025-AVI-1079 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP NetWeaver Internet Communication Framework | affected SAP_BASIS 700 ; affected SAP_BASIS 701 ; affected SAP_BASIS 702 ; affected SAP_BASIS 731 ; affected SAP_BASIS 740 ; affected SAP_BASIS 750 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |