GCVE-110-NCSC-2025-45

Advisory PublishedCVSS 5.3/10

Vulnetix · Advisory published February 11, 2025

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-284Improper Access ControlCWE-404Improper Resource Shutdown or ReleaseCWE-287Improper AuthenticationCWE-1188Initialization of a Resource with an Insecure DefaultCWE-732Incorrect Permission Assignment for Critical ResourceCWE-862Missing AuthorizationCWE-644Improper Neutralization of HTTP Headers for Scripting SyntaxCWE-204Observable Response DiscrepancyCWE-601URL Redirection to Untrusted Site ('Open Redirect')CWE-863Incorrect AuthorizationCWE-921Storage of Sensitive Data in a Mechanism without Access ControlCWE-1021Improper Restriction of Rendered UI Layers or FramesCWE-352Cross-Site Request Forgery (CSRF)

Risk Scores

CVSS 3.1

5.3/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions	Platforms
sap	abap_platform	—	—
sap	commerce	—	—
sap	netweaver_java_application_server	—	—
sap	netweaver_as_java_for_deploy_service	—	—
sap	netweaver	—	—
sap	netweaver_application_server_java	—	—
sap	supplier_relationship_management	—	—
sap	netweaver_server_abap	—	—
sap	netweaver_as_java	—	—
sap	commerce_backoffice	—	—

References

advisory

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON