SAP NetWeaver ABAP Auth Bypass in Function Module Retrieval
CVE-2025-42882 Published on November 11, 2025

Missing Authorization check in SAP NetWeaver Application Server for ABAP
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact on confidentiality, with no impact on the integrity or availability of the application.

NVD

Vulnerability Analysis

CVE-2025-42882 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2025-42882 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2025-42882

Want to know whenever a new CVE is published for SAP Netweaver Application Server Abap? stack.watch will email you.

SAP Netweaver Application Server Abap
 

Affected Versions

SAP_SE SAP NetWeaver Application Server for ABAP:

Exploit Probability

EPSS
0.04%
Percentile
10.99%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.