CVE-2025-24869— Information Disclosure vulnerability in SAP NetWeaver Application Server Java
Quick assessment
Affected
SAP_SE SAP NetWeaver Application Server Java
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP NetWeaver Application Server Java是德国思爱普（SAP）公司的一款提供了Java运行环境的应用程序服务器。该产品主要用于开发和运行Java EE应用程序。 SAP NetWeaver Application Server Java存在安全漏洞，该漏洞源于信息访问限制不足，会导致服务器组件信息泄露。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-24869
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure vulnerability in SAP NetWeaver Application Server Java
Source: CVE Program / CVE List V5
Vulnerability Description
SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
SAP NetWeaver Application Server Java 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver Application Server Java是德国思爱普（SAP）公司的一款提供了Java运行环境的应用程序服务器。该产品主要用于开发和运行Java EE应用程序。 SAP NetWeaver Application Server Java存在安全漏洞，该漏洞源于信息访问限制不足，会导致服务器组件信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server Java | WD-RUNTIME 7.50 | - |
|
II. Public POCs for CVE-2025-24869
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-24869
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2025-02-11 · 17 CVEs total
| CVE-2025-0064 | 8.7 HIGH | Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Mana |
| CVE-2025-25243 | 8.6 HIGH | Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Manageme |
| CVE-2025-24876 | 8.1 HIGH | Authentication bypass via authorization code injection in SAP Approuter |
| CVE-2025-24868 | 7.1 HIGH | Open Redirect Vulnerability in SAP HANA extended application services, advanced model (Use |
| CVE-2025-24874 | 6.8 MEDIUM | Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice |
| CVE-2025-24875 | 6.8 MEDIUM | SameSite Defense in Depth not applied for some cookies in SAP Commerce |
| CVE-2025-24867 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence plat |
| CVE-2025-24870 | 6.0 MEDIUM | Insecure Key & Secret Management vulnerability in SAP GUI for Windows |
| CVE-2025-0054 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java |
| CVE-2025-25241 | 5.4 MEDIUM | Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests) |
| CVE-2025-23187 | 5.3 MEDIUM | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) |
| CVE-2025-23193 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP |
| CVE-2025-23189 | 4.3 MEDIUM | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) |
| CVE-2025-23190 | 4.3 MEDIUM | Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI) |
| CVE-2025-24872 | 4.3 MEDIUM | Missing Authorization check in SAP ABAP Platform (ABAP Build Framework) |
| CVE-2025-23191 | 3.1 LOW | Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP |
IV. Related Vulnerabilities
Same product: SAP NetWeaver Application Server Java
-
CVE-2026-23686
CRLF Injection vulnerability in SAP NetWeaver Application Se -
CVE-2025-42919
Information Disclosure vulnerability in SAP NetWeaver Applic -
CVE-2025-42926
Missing Authentication check in SAP NetWeaver Application Se -
CVE-2025-42978
Insufficiently Secure Hostname Verification for Outbound TLS -
CVE-2025-27431
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap
Same vendor: SAP_SE
-
CVE-2026-66766
Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protec -
CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapt -
CVE-2026-66779
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approu
Same weakness: CWE-863
-
CVE-2026-78887
liketrek TREK Journey Photo Proxy validateShareTokenForAsset -
CVE-2026-79673
Ech0 before 4.4.3 Scope Bypass via profile:read Token -
CVE-2026-49050
Apache DolphinScheduler: General user can mint admin access -
CVE-2026-77134
Broken Access Control in extension "femanager" (femanager) -
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unl
V. Comments for CVE-2025-24869
No comments yet