EUVD-2026-72583
GHSA-79h6-mww5-hcf3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable with low-privilege auth required; only configuration metadata exposed, so C:L with no integrity or availability impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
3DescriptionCVE.org
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.
AnalysisAI
Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated SAP session with at least a low-privilege dialog or RFC user account on the targeted system - PR:L per the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the limited real-world impact: network-reachable, low complexity, but requiring a valid low-privileged SAP account and yielding only a low confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the correction delivered via SAP Security Note 3772838, available through the SAP Support Portal at https://me.sap.com/notes/3772838. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today