Auth bypass in SAP Se Netweaver And Abap Platform (St-Pi)
CVE-2025-23190
Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.
Vulnerability class: Broken Access Control
EPSS: 0.003 (16.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Sap_se Sap Netweaver And Abap Platform (St-pi) — versions ST-PI 2008_1_700, ST-PI 2008_1_710, ST-PI 740
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-23190?
- CVE-2025-23190 is a medium-severity vulnerability in SAP Se Netweaver And Abap Platform (St-Pi), classified under Missing Authorization. CVSS score: 4.3/10. Published 2025-02-11.
- How severe is CVE-2025-23190?
- Medium severity. CVSS v3 base score is 4.3 out of 10.