CVE-2025-42949

{"id": "CVE-2025-42949", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2025-08-12T03:15:27.657", "references": [{"url": "https://me.sap.com/notes/3626722", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected."}, {"lang": "es", "value": "Debido a la falta de una comprobaci\u00f3n de autorizaci\u00f3n en la plataforma ABAP, un usuario autenticado con privilegios elevados podr\u00eda eludir las restricciones de autorizaci\u00f3n para transacciones comunes utilizando la consola SQL. Esto podr\u00eda permitir que un atacante acceda y lea el contenido de las tablas de la base de datos sin la debida autorizaci\u00f3n, lo que comprometer\u00eda significativamente la confidencialidad de los datos. Sin embargo, la integridad y la disponibilidad del sistema permanecen intactas."}], "lastModified": "2025-08-12T14:25:33.177", "sourceIdentifier": "cna@sap.com"}