Main Vulnerability Database Vulnerabilities #VU105503

Information disclosure in SAP products - CVE-2025-0071

Published: March 11, 2025

Vulnerability identifier: #VU105503

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-0071

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote privileged user can gain unauthorized access to sensitive information on the system.

Affected software

SAP Web Dispatcher WEBDISP
Internet Communication Manager (ICM) KRNL64UC
SAP Web Dispatcher Kernel

How to mitigate CVE-2025-0071

Install updates from vendor's website.

External References

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html
https://me.sap.com/notes/3558132

Related Security Bulletins