CVE-2025-42968

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver (RFC enabled function module)	SAP_BW 700; 701; 702; 710; 731; 740; 750; 751; 752; 753; 754; 755; 756; 757; 758; 816; 914; 916

References

https://me.sap.com/notes/3621037Permissions Required
https://url.sap/sapsecuritypatchdayPatch

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-429696.1SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically c CVE-2025-42979.8A vulnerability was found in PHPGurukul Men Salon Management System 2.0. It has been classified as critical. This affects an unknown part of CVE-2025-429705.8SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive CVE-2025-429714.0A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim ex CVE-2025-429735.4Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search func CVE-2025-429744.3Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This CVE-2025-429756.1SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC CVE-2025-429768.1SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Docum CVE-2025-429777.6SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a hi CVE-2025-429783.5The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hos CVE-2025-429795.6The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for sto CVE-2025-42989.8A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formS