Medium severity · published Apr 8, 2025
CVE-2025-30015
Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
4.1
CVSS
0.3%
EPSS
No
On KEV
Description
Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output variable. This vulnerability has a low impact on the confidentiality, integrity and the availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver and ABAP Platform (Application Server ABAP) · SAP_SE
KRNL64UC 7.53; KERNEL 7.53; 7.54 · source: vendor
Affected product
SN
SAP NetWeaver and ABAP Platform (Application Server ABAP)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30015
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30015
me.sap.com
https://me.sap.com/notes/3565944
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver and ABAP Platform (Application Server ABAP)
3.1
CVE-2026-24320
Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)