SAP Security Patch Day: February 2025
Released February 11, 2025 · 16 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for February 11, 2025 (second Tuesday)
- SAP notes
- 16
- Critical
- 0
- High
- 4
- Highest CVSS
- 8.7
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
16 notes with SAP CVEs. 0 Critical and 4 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 8.7.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)
Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)
Authentication bypass via authorization code injection in SAP Approuter
Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3525794 | Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console) New | SAP BusinessObjects BI Platform | High | 8.7 | CVE-2025-0064 |
| 3567551 | Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) New | SAP Supplier Relationship Management | High | 8.6 | CVE-2025-25243 |
| 3567974 | Authentication bypass via authorization code injection in SAP Approuter New | SAP Approuter Node.js package | High | 8.1 | CVE-2025-24876 |
| 3563929 | Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services) New | SAP HANA extended application services, advanced model | High | 7.1 | CVE-2025-24868 |
| 3555364 | SameSite Defense in Depth not applied for some cookies in SAP Commerce New | SAP Commerce Cloud | Medium | 6.8 | CVE-2025-24875 |
| 3559510 | Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice New | SAP Commerce Cloud | Medium | 6.8 | CVE-2025-24874 |
| 3445708 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad) New | SAP BusinessObjects BI Platform | Medium | 6.1 | CVE-2025-24867 |
| 3562336 | Insecure Key & Secret Management vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 6.0 | CVE-2025-24870 |
| 3526203 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 5.4 | CVE-2025-0054 |
| 3532025 | Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests) New | SAP Fiori Apps Reference Library | Medium | 5.4 | CVE-2025-25241 |
| 3546470 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2025-23187, CVE-2025-23189 |
| 3561264 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2025-23193 |
| 3547581 | Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-23190 |
| 3550027 | Information Disclosure vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 4.3 | CVE-2025-24869 |
| 3553753 | Missing Authorization check in SAP ABAP Platform (ABAP Build Framework) New | SAP ABAP Platform | Medium | 4.3 | CVE-2025-24872 |
| 3426825 | Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP New | SAP Fiori for SAP ERP | Low | 3.1 | CVE-2025-23191 |