PT-2025-49770 · Sap · Sap Enterprise Search For Abap

Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-42891

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Enterprise Search for ABAP (affected versions not specified)

Description A missing authorization check in SAP Enterprise Search for ABAP allows an attacker with high privileges to read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data integrity. There is no impact on application availability. The issue involves a flaw in authorization controls, potentially allowing unauthorized access to sensitive data within database tables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-15899

CVE-2025-42891

Affected Products

Sap Enterprise Search For Abap

References · 7

• https://bdu.fstec.ru/vul/2025-15899 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42891 · Security Note
• https://twitter.com/CVEnew/status/1998225333942927748 · Twitter Post
• https://t.me/CVEtracker/39199 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://me.sap.com/notes/3659117 · Note