CVE-2025-42953

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-429542.7SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function CVE-2025-429553.5Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted req CVE-2025-429566.1SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make pu CVE-2025-429579.9SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the CVE-2025-429589.1Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized CVE-2025-429598.1An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system mis CVE-2025-42964.7URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing. This issue affects B2B: befo CVE-2025-429604.3SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting i CVE-2025-429614.9Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit CVE-2025-429626.1SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link, CVE-2025-429639.1A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe CVE-2025-429649.1SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when de