CVE-2025-42997

Information Disclosure vulnerability in SAP Gateway Client

Severity Score

6.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

Multiple

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2025-04-16 CVE Reserved
2025-05-13 CVE Published
2025-05-13 CVE Updated
2025-06-14 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-732: Incorrect Permission Assignment for Critical Resource

CAPEC

References (2)

URL	Tag	Source
https://me.sap.com/notes/3577300
https://url.sap/sapsecuritypatchday

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
SAP SE Search vendor "SAP SE"		SAP Gateway Client Search vendor "SAP SE" for product "SAP Gateway Client"				753 Search vendor "SAP SE" for product "SAP Gateway Client" and version "753"		en		Affected
SAP SE Search vendor "SAP SE"		SAP Gateway Client Search vendor "SAP SE" for product "SAP Gateway Client"				754 Search vendor "SAP SE" for product "SAP Gateway Client" and version "754"		en		Affected
SAP SE Search vendor "SAP SE"		SAP Gateway Client Search vendor "SAP SE" for product "SAP Gateway Client"				755 Search vendor "SAP SE" for product "SAP Gateway Client" and version "755"		en		Affected
SAP SE Search vendor "SAP SE"		SAP Gateway Client Search vendor "SAP SE" for product "SAP Gateway Client"				756 Search vendor "SAP SE" for product "SAP Gateway Client" and version "756"		en		Affected
SAP SE Search vendor "SAP SE"		SAP Gateway Client Search vendor "SAP SE" for product "SAP Gateway Client"				757 Search vendor "SAP SE" for product "SAP Gateway Client" and version "757"		en		Affected
SAP SE Search vendor "SAP SE"		SAP Gateway Client Search vendor "SAP SE" for product "SAP Gateway Client"				758 Search vendor "SAP SE" for product "SAP Gateway Client" and version "758"		en		Affected