CVE-2025-42986

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3626440	Permissions Required
https://url.sap/sapsecuritypatchday	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:sap_basis:700:::::::*
	cpe:2.3:a:sap:sap_basis:701:::::::*
	cpe:2.3:a:sap:sap_basis:702:::::::*
	cpe:2.3:a:sap:sap_basis:731:::::::*
	cpe:2.3:a:sap:sap_basis:740:::::::*
	cpe:2.3:a:sap:sap_basis:750:::::::*
	cpe:2.3:a:sap:sap_basis:751:::::::*
	cpe:2.3:a:sap:sap_basis:752:::::::*
	cpe:2.3:a:sap:sap_basis:753:::::::*
	cpe:2.3:a:sap:sap_basis:754:::::::*

History

27 Oct 2025, 16:55

Type	Values Removed	Values Added
CPE		cpe:2.3:a:sap:sap_basis:701:::::::* cpe:2.3:a:sap:sap_basis:754:::::::* cpe:2.3:a:sap:sap_basis:750:::::::* cpe:2.3:a:sap:sap_basis:740:::::::* cpe:2.3:a:sap:sap_basis:702:::::::* cpe:2.3:a:sap:sap_basis:752:::::::* cpe:2.3:a:sap:sap_basis:751:::::::* cpe:2.3:a:sap:sap_basis:753:::::::* cpe:2.3:a:sap:sap_basis:731:::::::* cpe:2.3:a:sap:sap_basis:700:::::::*
First Time		Sap Sap sap Basis
References	~~() https://me.sap.com/notes/3626440 -~~	() https://me.sap.com/notes/3626440 - Permissions Required
References	~~() https://url.sap/sapsecuritypatchday -~~	() https://url.sap/sapsecuritypatchday - Patch

08 Jul 2025, 16:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-08 01:15

Updated : 2025-10-27 16:55

NVD link : CVE-2025-42986

Mitre link : CVE-2025-42986

CVE.ORG link : CVE-2025-42986

JSON object : View

Products Affected

sap

sap_basis

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-42986", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-07-08T01:15:25.730", "references": [{"url": "https://me.sap.com/notes/3626440", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Patch"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application."}, {"lang": "es", "value": "Debido a la falta de una verificaci\u00f3n de autorizaci\u00f3n en un m\u00f3dulo de funci\u00f3n obsoleto habilitado para RFC en SAP BASIS, un atacante autenticado con pocos privilegios podr\u00eda ejecutar una Llamada a Funci\u00f3n Remota (RFC), lo que podr\u00eda permitir el acceso a informaci\u00f3n restringida del sistema. Esto genera un impacto m\u00ednimo en la confidencialidad, sin afectar la integridad ni la disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2025-10-27T16:55:48.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:sap_basis:700:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85616273-040E-49CB-8EB6-D2D4D7B603E5"}, {"criteria": "cpe:2.3:a:sap:sap_basis:701:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5F2C3A9-DCC0-4FF1-8E68-9EA150E209F6"}, {"criteria": "cpe:2.3:a:sap:sap_basis:702:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F774A45-2A9F-4873-A5DC-766D030C8CCD"}, {"criteria": "cpe:2.3:a:sap:sap_basis:731:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3A0A2D6-9259-4A35-A236-F4BEE986C1FD"}, {"criteria": "cpe:2.3:a:sap:sap_basis:740:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49C3A8E5-FA6A-4EF3-BF50-FD4E1576024F"}, {"criteria": "cpe:2.3:a:sap:sap_basis:750:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABA8AB4E-3FE6-46A8-847E-660C5DF6CE71"}, {"criteria": "cpe:2.3:a:sap:sap_basis:751:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DA4A6F0-C0F1-42CB-8BBD-7198064733EA"}, {"criteria": "cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C121CC9-26F6-4103-8EB0-BAFF6B5B5FE8"}, {"criteria": "cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86086D00-10BF-4C55-8D87-82CCBE468153"}, {"criteria": "cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F25246A-D9E5-4F0D-B91A-478D4E5570DB"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}