PT-2025-32602 · Sap · Sap Netweaver Application Server Abap

Published 2025-08-11 · Updated 2025-10-23 · CVE-2025-42936

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP (affected versions not specified)

Description: The application server does not allow administrators to assign distinguished authorizations for different user roles. This allows authenticated users to access restricted objects in the barcode interface, potentially leading to privilege escalation. The issue has a low impact on the confidentiality and integrity of the application and does not affect availability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2025-16307

CVE-2025-42936

Affected Products

Sap Netweaver Application Server Abap

References · 10

• https://url.sap/sapsecuritypatchday · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-42936 · Security Note
• https://bdu.fstec.ru/vul/2025-16307 · Security Note
• https://osv.dev/vulnerability/CVE-2025-42936 · Vendor Advisory
• https://t.me/cveNotify/131769 · Telegram Post
• https://t.me/cveNotify/139991 · Telegram Post
• https://me.sap.com/notes/3602656 · Note
• https://t.me/CVEtracker/29728 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2025.html · Note
• https://twitter.com/CVEnew/status/1955101092104052936 · Twitter Post