What is CVE-2025-0063?

CVE-2025-0063 is a high-severity vulnerability in SAP Basis, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-01-14.

How severe is CVE-2025-0063?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in SAP Basis

CVE-2025-0063

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.

Vulnerability class: SQL Injection

EPSS: 0.007 (52.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sap Sap_basis — versions 700, 701, 702
Sap_se Sap Netweaver As Abap And Platform — versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cna@sap.com (Permissions Required)
cna@sap.com (Patch)

Frequently asked questions

What is CVE-2025-0063?: CVE-2025-0063 is a high-severity vulnerability in SAP Basis, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-01-14.
How severe is CVE-2025-0063?: High severity. CVSS v3 base score is 8.8 out of 10.