CVE-2025-23194

Summary (CVE-2025-23194) : SAP NetWeaver Enterprise Portal OBN has a missing authentication check for a specific configuration setting. This allows a non-authenticated user to alter the setting to an undesired value, resulting in a low integrity impact. No confidentiality or availability impact i...

CVE-2025-23194 Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component)

SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentiality or availability of the application...

SAP NetWeaver ABAP Server 安全漏洞

SAP NetWeaver ABAP Server is a web application server from SAP, Germany, that is used as a web application server for SAP products. A security vulnerability exists in SAP NetWeaver ABAP Server that stems from a lack of authorization checking and could lead to elevated privileges and information...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server that stems from insufficiently encoded user input and could lead to a cross-site scripting attack...

SAP NetWeaver Application Server Java Cross-Site Scripting Vulnerability

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used to develop and run Java EE applications. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server Java, which can be...

SAP NetWeaver Application Server Java Information Disclosure Vulnerability (CNVD-2025-03268)

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used to develop and run Java EE applications. An information disclosure vulnerability exists in SAP NetWeaver Application Server Java, which can b...

SAP NetWeaver AS Java Multiple Vulnerabilities (Feb 2025)

SAP NetWeaver Application Server for Java is affected by multiple vulnerabilities, including the following: - The User Admin application of SAP NetWeaver AS for Java insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This resul...

CVE-2025-23193

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server...

CVE-2025-24869

SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML fil...

CVE-2025-0054

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web...

CVE-2025-24869

SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML fil...

CVE-2025-23193

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server...

CVE-2025-0054

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web...

CVE-2025-24869 Information Disclosure vulnerability in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML fil...

CVE-2025-24869

CVE-2025-24869 affects SAP NetWeaver Application Server Java. The issue is an information-disclosure vulnerability where an attacker can access an endpoint that reveals details about deployed server components, including their XML definitions. These XML files are deployed with the server and are ...

CVE-2025-24869 Information Disclosure vulnerability in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML fil...

CVE-2025-23193 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server...

CVE-2025-23193 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server...

CVE-2025-23193

CVE-2025-23193 describes an information-disclosure vulnerability in SAP NetWeaver Server ABAP. An unauthenticated attacker can provoke the server to respond differently depending on the existence of a specified user, potentially leaking sensitive information. The issue does not enable data modifi...

CVE-2025-23190 Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...