Missing Authorization check in SAP NetWeaver Application Server for ABAP_CVE-2025-42936

{
    "lastseen": "",
    "description": "The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.",
    "published": "2025-08-12T02:05:19.690Z",
    "modified": "2025-08-12T02:05:19.690Z",
    "type": "cve",
    "title": "Missing Authorization check in SAP NetWeaver Application Server for ABAP",
    "source": "sap",
    "references": "https://me.sap.com/notes/3602656\nhttps://url.sap/sapsecuritypatchday",
    "id": "CVE-2025-42936",
    "bulletinFamily": "",
    "cwe": [
        "CWE-266"
    ],
    "cvelist": null,
    "sourceData": "SAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 700\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 701\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 702\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 731\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 740\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 750\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 751\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 752\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 753\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 754\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 755\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 756\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 757\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 758\nSAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 816",
    "sourceHref": "",
    "cvss": {
        "score": 5.4,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "SAP NetWeaver Application Server for ABAP",
    "version": "SAP_BASIS 700",
    "vendor": "SAP_SE",
    "ai_description": "The SAP NetWeaver Application Server for ABAP lacks proper authorization checks in the barcode interface, allowing authenticated users to escalate privileges and access restricted objects.",
    "ai_severity": "MEDIUM",
    "ai_vendor": "SAP",
    "ai_product": "NetWeaver Application Server for ABAP",
    "ai_version": "700,701,702,731,740,750,751,752,753,754,755,756,757,758,816",
    "ai_score": 5.4
}