Medium severity · published Jan 14, 2025
CVE-2025-0058
Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business Workflow and SAP Flexible Workflow · SAP_SE
SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758; +3 more · source: vendor
SB
Sap Basis · Sap
753; 754; 755; 756; 757; 758; +3 more · source: NVD
Affected product
SB
SAP Business Workflow and SAP Flexible Workflow
SAP_SE