CVE-2025-23193 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP
Unauthenticated attackers can determine user existence via response differences, revealing sensitive information in SAP NetWeaver ABAP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-23193?
CVE-2025-23193 is a medium-severity vulnerability in SAP_SE SAP NetWeaver Server ABAP, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server availability.
Weakness: CWE-204
Which versions are affected by CVE-2025-23193?
It affects 1 product.
Products include Sap Sap Basis.
How do I fix CVE-2025-23193?
No fix has been published for CVE-2025-23193 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-23193 being exploited?
There is no known exploitation of CVE-2025-23193 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP NetWeaver Server ABAP
- CVE-2025-0066 Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
- CVE-2026-23687 XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2025-0063 SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2026-0484 Missing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA
- CVE-2025-0058 Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow
Sources
Also known as GHSA-62m9-v7g3-w362.