Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-42959— Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476

CVSS 8.1 · High EPSS 0.22% · P44
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-42959

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476
Source: NVD (National Vulnerability Database)
Vulnerability Description
An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation could result in complete system compromise, affecting confidentiality, integrity, and availability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用单一因素认证机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
SAP NetWeaver ABAP Server和SAP ABAP Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver ABAP Server和SAP ABAP Platform都是德国思爱普（SAP）公司的产品。SAP NetWeaver ABAP Server是一个用作 SAP 产品的 Web 应用程序服务器。SAP ABAP Platform是一个基于 ABAP 的 SAP 解决方案。 SAP NetWeaver ABAP Server和SAP ABAP Platform存在安全漏洞，该漏洞源于未验证攻击者可利用从缺失特定补丁的系统提取的HMAC凭据进行重放攻击，可能导致完全系统破解。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SAP_SESAP NetWeaver ABAP Server and ABAP Platform SAP_BASIS 700 -

II. Public POCs for CVE-2025-42959

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-42959

请登录查看更多情报信息。

Same Patch Batch · SAP_SE · 2025-07-08 · 27 CVEs total

CVE-2025-429679.9 CRITICALCode Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)
CVE-2025-429649.1 CRITICALInsecure Deserialization in SAP NetWeaver Enterprise Portal Administration
CVE-2025-429669.1 CRITICALInsecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)
CVE-2025-429809.1 CRITICALInsecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network
CVE-2025-429639.1 CRITICALInsecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )
CVE-2025-429538.1 HIGHMissing Authorization check in SAP NetWeaver Application Server for ABAP
CVE-2025-429527.7 HIGHMissing Authorization check in SAP Business Warehouse and SAP Plug-In Basis
CVE-2025-429926.9 MEDIUMMultiple Privilege Escalation Vulnerabilities in SAPCAR
CVE-2025-430016.9 MEDIUMMultiple Privilege Escalation Vulnerabilities in SAPCAR
CVE-2025-429626.1 MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web
CVE-2025-429696.1 MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP
CVE-2025-429816.1 MEDIUMMultiple vulnerabilities in SAP NetWeaver Application Server ABAP
CVE-2025-429856.1 MEDIUMOpen Redirect vulnerability in SAP BusinessObjects Content Administrator workbench
CVE-2025-429705.8 MEDIUMDirectory Traversal vulnerability in SAPCAR
CVE-2025-429795.6 MEDIUMInsecure Key & Secret Management vulnerability in SAP GUI for Windows
CVE-2025-429735.4 MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)
CVE-2025-429685.0 MEDIUMMissing Authorization check in SAP NetWeaver (RFC enabled function module)
CVE-2025-429614.9 MEDIUMMissing Authorization check in SAP NetWeaver Application Server for ABAP
CVE-2025-429744.3 MEDIUMMissing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)
CVE-2025-429604.3 MEDIUMMissing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx Tools

Showing top 20 of 27 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: SAP NetWeaver ABAP Server and ABAP Platform
Same vendor: SAP_SE
Same weakness: CWE-308

V. Comments for CVE-2025-42959

No comments yet

Leave a comment