CVE-2025-0056— Information Disclosure vulnerability in SAP GUI for Java
Quick assessment
Affected
SAP_SE SAP GUI for Java
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP GUI是德国思爱普（SAP）公司的一个应用软件。SAP系统的图形用户界面。 SAP GUI for Java存在安全漏洞，该漏洞源于将用户输入保存在客户端PC上以提高可用性，攻击者能够读取此数据。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-0056
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure vulnerability in SAP GUI for Java
Source: CVE Program / CVE List V5
Vulnerability Description
SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
将系统数据暴露到未授权控制的范围
Source: CVE Program / CVE List V5
Vulnerability Title
SAP GUI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP GUI是德国思爱普（SAP）公司的一个应用软件。SAP系统的图形用户界面。 SAP GUI for Java存在安全漏洞，该漏洞源于将用户输入保存在客户端PC上以提高可用性，攻击者能够读取此数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP GUI for Java | BC-FES-JAV 7.80 | - |
|
II. Public POCs for CVE-2025-0056
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-0056
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2025-01-14 · 14 CVEs total
| CVE-2025-0066 | 9.9 CRITICAL | Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Inter |
| CVE-2025-0070 | 9.9 CRITICAL | Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform |
| CVE-2025-0063 | 8.8 HIGH | SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform |
| CVE-2025-0061 | 8.7 HIGH | Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform |
| CVE-2025-0069 | 7.8 HIGH | DLL Hijacking vulnerability in SAPSetup |
| CVE-2025-0058 | 6.5 MEDIUM | Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow |
| CVE-2025-0060 | 6.5 MEDIUM | Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform |
| CVE-2025-0067 | 6.3 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server Java |
| CVE-2025-0055 | 6.0 MEDIUM | Information Disclosure vulnerability in SAP GUI for Windows |
| CVE-2025-0059 | 6.0 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (application |
| CVE-2025-0053 | 5.3 MEDIUM | Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP |
| CVE-2025-0057 | 4.8 MEDIUM | Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application) |
| CVE-2025-0068 | 4.3 MEDIUM | Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Ser |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapt -
CVE-2026-66779
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66776
Multiple vulnerabilities in SAP Business AI Platform (Approu
Same weakness: CWE-497
-
CVE-2026-75928
Brushfire unauthenticated information disclosure -
CVE-2026-67267
Dell Command Update 信息泄露漏洞 -
CVE-2026-74007
WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image -
CVE-2026-32468
WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensiti -
CVE-2024-58375
OpenTofu before 1.8.3 Secret Variable Leaking via Static Eva
V. Comments for CVE-2025-0056
No comments yet