Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM) (SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM))
At a glance
- Source
- NVD
- EPSS
- EPSS 0.36 % · percentile 30 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Deferred
Description
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.
Weaknesses (CWE)
- CWE-1244 — Internal Asset Exposed to Unsafe Debug Access Level or State
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H | sap |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-201849
- GCVE · GCVE-0-2025-42878
CERT-FR advisories
- CERTFR-2025-AVI-1079 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Web Dispatcher and Internet Communication Manager (ICM) | affected KRNL64NUC 7.22 ; affected 7.22EXT ; affected KRNL64UC 7.22 ; affected 7.53 ; affected WEBDISP 7.22_EXT ; affected 7.54 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |