PT-2025-15363 · Sap · Sap Netweaver Application Server Abap

Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-23186

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP (affected versions not specified)

Description: The issue allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, exposing credentials for a remote service. These credentials can then be exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-06364

CVE-2025-23186

Affected Products

Sap Netweaver Application Server Abap

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-23186 · Security Note
• https://bdu.fstec.ru/vul/2025-06364 · Security Note
• https://twitter.com/CVEnew/status/1909528301716357408 · Twitter Post
• https://t.me/cvetracker/21085 · Telegram Post
• https://me.sap.com/notes/3554667 · Note
• https://twitter.com/vulns_space/status/1909532005181554930 · Twitter Post
• https://twitter.com/cybercronai/status/1909671460953546855 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html · Note
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/cvedetector/22430 · Telegram Post