{"id":"CVE-2025-42949","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-42949","generatedAt":"2026-10-28T02:17:57.327Z","title":"Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console.","description":"Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.","published":"2025-08-12T03:15:28.000Z","lastModified":"2026-06-17T09:23:17.000Z","status":"Deferred","sourceIdentifier":"cna@sap.com","cvss":{"version":"3.1","score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-862"],"affected":[],"epss":{"score":0.00324,"percentile":0.25178,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://me.sap.com/notes/3626722","source":"cna@sap.com"},{"url":"https://url.sap/sapsecuritypatchday","source":"cna@sap.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-42949","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}