Medium severity · published Apr 8, 2025
CVE-2025-31331
Authorization Bypass vulnerability in SAP NetWeaver
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the ABAP system, the attacker can run a specific transaction that exposes sensitive system code without proper authorization. This vulnerability compromises the confidentiality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver · SAP_SE
SAP_ABA 700; 701; 702; 731; 740; 750; +9 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31331
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-31331
me.sap.com
https://me.sap.com/notes/3577131
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver
9.1
CVE-2025-42958
Missing Authentication check in SAP NetWeaver
5.3
CVE-2024-27898
Server-Side Request Forgery in SAP NetWeaver
