Medium severity · published Jan 14, 2025
CVE-2025-0067
Missing Authorization check in SAP NetWeaver Application Server Java
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver Application Server Java · SAP_SE
WD-RUNTIME 7.50 · source: vendor
Affected product
SN
SAP NetWeaver Application Server Java
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0067
me.sap.com
https://me.sap.com/notes/3540108
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver Application Server Java
5.4
CVE-2025-27431
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
5.4
CVE-2025-0054
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
5.3
CVE-2025-42919
Information Disclosure vulnerability in SAP NetWeaver Application Server Java
5.3
CVE-2025-42926
Missing Authentication check in SAP NetWeaver Application Server Java
4.3
CVE-2025-24869
Information Disclosure vulnerability in SAP NetWeaver Application Server Java