SAP Security Notes Review: April 2025

[CVE-2025-30017] Missing Authorisation check in SAP Solution Manager (SAP Note 3558864)

Due to a missing authorisation check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application.

[CVE-2025-27437] Missing Authorisation check in SAP NetWeaver Application Server ABAP (Virus Scan Interface) (SAP note 3568778)

A missing authorisation check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate a transaction, allowing them to access but not modify non-sensitive data without further authorisation and with no effect on availability.

[CVE-2025-31331] Authorisation Bypass vulnerability in SAP NetWeaver (SAP Note 3577131)

SAP NetWeaver allows attackers to bypass authorisation checks, allowing them to view portions of ABAP code that would typically require additional validation. Once logged into the ABAP system, the attacker can run a specific transaction that exposes sensitive system code without proper authorisation. This vulnerability compromises the confidentiality.

[CVE-2025-30013] Code Injection vulnerability in SAP ERP BW Business Content (SAP Note 3571093)

SAP ERP BW Business Content is vulnerable to OS Command Injection through specific function modules. When executed with elevated privileges, these function modules improperly handle user input, allowing an attacker to inject arbitrary OS commands by accessing the target system locally. This vulnerability allows the execution of unintended commands on the underlying system, posing a significant security risk to the application’s confidentiality, integrity and availability.