CVE-2025-0056

SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.

• CWE-497

• https://me.sap.com/notes/3502459
• https://url.sap/sapsecuritypatchday

Published

Jan 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0050Improper Restriction of Operations within the Bounds of a Me…5.9
• CVE-2025-0051Improper input validation performed during the authenticatio…8.7
• CVE-2025-0052Improper input validation performed during the authenticatio…8.3
• CVE-2025-0053SAP NetWeaver Application Server for ABAP and ABAP Platform …5.3
• CVE-2025-0054SAP NetWeaver Application Server Java does not sufficiently …5.4
• CVE-2025-0055SAP GUI for Windows stores user input on the client PC to im…6
• CVE-2025-0057SAP NetWeaver AS JAVA (User Admin Application) is vulnerable…4.8
• CVE-2025-0058In SAP Business Workflow and SAP Flexible Workflow, an authe…6.5
• CVE-2025-0059Applications based on SAP GUI for HTML in SAP NetWeaver Appl…6
• CVE-2025-0060SAP BusinessObjects Business Intelligence Platform allows an…6.5
• CVE-2025-0061SAP BusinessObjects Business Intelligence Platform allows an…9.1
• CVE-2025-0062SAP BusinessObjects Business Intelligence Platform allows an…4.7