Auth bypass in SAP Basis
CVE-2025-0058
In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.003 (25.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Sap Sap_basis — versions 753, 754, 755
- Sap_se Sap Business Workflow And Flexible — versions SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755
Weakness classification (CWE)
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Patch)
Frequently asked questions
- What is CVE-2025-0058?
- CVE-2025-0058 is a medium-severity vulnerability in SAP Basis, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2025-01-14.
- How severe is CVE-2025-0058?
- Medium severity. CVSS v3 base score is 6.5 out of 10.