NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP producten
view advisory published 2025-02-11
SAP heeft kwetsbaarheden verholpen in onder andere SAP NetWeaver, BusinessObjects Business Intelligence platform, Enterprise Project Connection en Commerce.
01
describes (24)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-25243US | — | — | ||
SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the… | ||||
| CVE-2025-25241US | —OT elevated | — | ||
Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee informat… | ||||
| CVE-2025-24876US | — | — | ||
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the vic… | ||||
| CVE-2025-24875US | — | — | ||
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoff… | ||||
| CVE-2025-24874US | — | — | ||
SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the fut… | ||||
| CVE-2025-24872US | —OT elevated | — | ||
The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality wi… | ||||
| CVE-2025-24870US | — | — | ||
SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulti… | ||||
| CVE-2025-24869US | —OT elevated | — | ||
SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This… | ||||
| CVE-2025-24868US | — | — | ||
The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craf… | ||||
| CVE-2025-24867US | — | — | ||
SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application allows an unauthenticate… | ||||
| CVE-2025-23193US | high7.5 | — | ||
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, po… | ||||
| CVE-2025-23191US | — | — | ||
Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the… | ||||
| CVE-2025-23190US | —OT elevated | — | ||
Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access… | ||||
| CVE-2025-23189US | —OT elevated | — | ||
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact… | ||||
| CVE-2025-23187US | —OT elevated | — | ||
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impac… | ||||
| CVE-2025-0064US | medium6.5 | — | ||
Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a s… | ||||
| CVE-2025-0054US | — | Exploit | ||
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic… | ||||
| CVE-2024-38819US | — | Exploit | ||
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP r… | ||||
| CVE-2024-38828US | — | Exploit | ||
Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack. | ||||
| CVE-2024-38820US | medium5.3 | Exploit | ||
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially… | ||||
showing 20 of 24
02
references
External citations — patches, advisories, analysis.
- Reference - ncscclearexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan