CVE-2025-0068: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

An obsolete functionality in SAP NetWeaver Application Server ABAP contained a vulnerability related to missing authorization checks. The vulnerability was disclosed on January 13, 2025, affecting SAP NetWeaver Application Server ABAP systems. This security issue allows authenticated attackers to access restricted information (NVD, CVE Mitre).

The vulnerability stems from insufficient authorization checks in an obsolete functionality within SAP NetWeaver Application Server ABAP. The issue has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is tracked under CWE-862 (Missing Authorization) (NVD).

The vulnerability impacts the confidentiality of the system by allowing authenticated attackers to access information that should be restricted. Notably, the vulnerability has no impact on the system's integrity or availability (NVD).

SAP has released security patches to address this vulnerability. Users are advised to review and implement the security notes available through the SAP Security Patch Day program (SAP Security).