What is CVE-2025-0067?

CVE-2025-0067 is a medium-severity vulnerability in Sap_se Sap Netweaver Application Server Java, classified under Missing Authorization. CVSS score: 6.3/10. Published 2025-01-14.

How severe is CVE-2025-0067?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Auth bypass in Sap_se Sap Netweaver Application Server Java

CVE-2025-0067

Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the applicat…

Vulnerability class: Broken Access Control

EPSS: 0.002 (16.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Sap_se Sap Netweaver Application Server Java — versions WD-RUNTIME 7.50

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2025-0067?: CVE-2025-0067 is a medium-severity vulnerability in Sap_se Sap Netweaver Application Server Java, classified under Missing Authorization. CVSS score: 6.3/10. Published 2025-01-14.
How severe is CVE-2025-0067?: Medium severity. CVSS v3 base score is 6.3 out of 10.