TI-2025-00035 Aliases CVE-2025-0058 GHSA-qgh2-cjfr-4xrc

Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow

LOW 29CWE-639Published 2025-01-14 · Updated 2025-01-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00341 27th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Business Workflow and SAP Flexible Workflow	SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758; SAP_BASIS 912; SAP_BASIS 913; SAP_BASIS 914	—	No fix listed	CNA

SAP Business Workflow and SAP Flexible Workflow VendorSAP Affected SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758; SAP_BASIS 912; SAP_BASIS 913; SAP_BASIS 914 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:sap_basis:753:::::::*	753	Vulnerable	SAP
cpe:2.3:a:sap:sap_basis:754:::::::*	754	Vulnerable	SAP
cpe:2.3:a:sap:sap_basis:755:::::::*	755	Vulnerable	SAP
cpe:2.3:a:sap:sap_basis:756:::::::*	756	Vulnerable	SAP
cpe:2.3:a:sap:sap_basis:757:::::::*	757	Vulnerable	SAP
cpe:2.3:a:sap:sap_basis:758:::::::*	758	Vulnerable	SAP
cpe:2.3:a:sap:sap_basis:912:::::::*	912	Vulnerable	SAP
cpe:2.3:a:sap:sap_basis:913:::::::*	913	Vulnerable	SAP
cpe:2.3:a:sap:sap_basis:914:::::::*	914	Vulnerable	SAP

cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:* Versions 757 Vulnerable ·SAP
cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:* Versions 758 Vulnerable ·SAP
cpe:2.3:a:sap:sap_basis:912:*:*:*:*:*:*:* Versions 912 Vulnerable ·SAP
cpe:2.3:a:sap:sap_basis:913:*:*:*:*:*:*:* Versions 913 Vulnerable ·SAP
cpe:2.3:a:sap:sap_basis:914:*:*:*:*:*:*:* Versions 914 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-0058
2026-10-03 Alias added: GHSA-qgh2-cjfr-4xrc

References

Patch 1

https://url.sap/sapsecuritypatchday

Other 1

https://me.sap.com/notes/3542698

TI-2025-00043 Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) CVSS 3.1CRITICAL 9.9
TI-2026-19074 XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1HIGH 8.8
TI-2025-00040 SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1HIGH 8.8
TI-2024-22986 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.0
TI-2016-03917 The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s… CVSS 3.0HIGH 7.5
TI-2025-16978 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP CVSS 3.1HIGH 7.5

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences