Auth bypass in SAP Basis
CVE-2025-0058
In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (24.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 24.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- SAP Basis — versions 753, 754, 755
- SAP Se Business Workflow And Flexible — versions SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755
Weakness classification (CWE)
References
- me.sap.com/notes/3542698 (Permissions Required)
- url.sap/sapsecuritypatchday (Patch)
Frequently asked questions
- What is CVE-2025-0058?
- CVE-2025-0058 is a medium-severity vulnerability in SAP Basis, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2025-01-14.
- How severe is CVE-2025-0058?
- Medium severity. CVSS v3 base score is 6.5 out of 10.