CVE-2025-0071: SAP Web Dispatcher Information Disclosure

CVE-2025-0071 Overview

CVE-2025-0071 affects SAP Web Dispatcher and SAP Internet Communication Manager (ICM). An attacker with administrative privileges can enable a debugging trace mode using a specific parameter value. Once enabled, the trace logs expose unencrypted passwords, resulting in a high impact to confidentiality.

The vulnerability is classified under [CWE-532: Insertion of Sensitive Information into Log File]. It does not affect integrity or availability of the application. Exploitation requires network access and existing high-privilege administrative credentials, limiting the attack surface to insider threats or attackers who have already compromised administrative accounts.

Critical Impact
Enabling the affected debug trace mode writes cleartext credentials to SAP log files, exposing authentication material to anyone with log-read access.

Affected Products

SAP Web Dispatcher
SAP Internet Communication Manager (ICM)
SAP NetWeaver components relying on Web Dispatcher or ICM trace facilities

Discovery Timeline

2025-03-11 - CVE-2025-0071 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-0071

Vulnerability Analysis

SAP Web Dispatcher and ICM handle HTTP(S) traffic entering SAP application environments. Both components support configurable trace levels intended for troubleshooting. When an administrator enables a specific debug trace parameter value, the components write full request and authentication data to trace files without redacting credentials.

Passwords transmitted during authentication requests are stored in plaintext within the trace logs. Any user or process with read access to those log files can recover the credentials. In production deployments, trace files are frequently shipped to log aggregation platforms, expanding the exposure beyond the SAP host itself.

The issue is a logging hygiene defect rather than a protocol or memory-safety flaw. It aligns with [CWE-532], which covers cases where sensitive data is written to log files without appropriate masking.

Root Cause

The trace subsystem does not sanitize password fields before writing HTTP request payloads to disk. When the debug trace parameter is set to the affected value, the components emit verbose diagnostic output containing full authentication headers and form fields.

Attack Vector

Exploitation requires an attacker with administrative privileges to the SAP Web Dispatcher or ICM configuration. The attacker enables the debug trace mode, waits for user authentication traffic to be logged, and then retrieves cleartext passwords from the trace files. Attackers can escalate by harvesting credentials for downstream SAP systems, service accounts, or federated identities used during authentication.

No verified public exploit code is available. Refer to SAP Note #3558132 for vendor technical details.

Detection Methods for CVE-2025-0071

Indicators of Compromise

Unexpected changes to SAP Web Dispatcher or ICM trace level parameters, particularly settings that enable verbose HTTP payload logging.
Presence of Authorization headers, sap-password fields, or form-based credential values inside dev_webdisp, dev_icm, or related trace files.
Access to trace files by accounts that do not normally perform SAP troubleshooting activities.

Detection Strategies

Audit SAP profile parameters and runtime configuration for trace level changes, especially values that enable request body or header dumping.
Scan existing trace files for credential patterns and flag any matches for rotation and investigation.
Correlate administrator logins with subsequent modifications to icm/trace_level, wdisp/trace_level, or equivalent parameters.

Monitoring Recommendations

Forward SAP Web Dispatcher and ICM configuration change events to a centralized SIEM for continuous review.
Alert on read access to trace directories from non-administrative accounts and from log-shipping agents outside approved allowlists.
Establish a baseline for expected trace levels and generate alerts whenever runtime values deviate from the baseline.

How to Mitigate CVE-2025-0071

Immediate Actions Required

Apply the patches referenced in SAP Note #3558132 to affected Web Dispatcher and ICM installations.
Review all existing trace files for exposed credentials and rotate any passwords found in cleartext.
Restrict administrative access to SAP Web Dispatcher and ICM configuration to a minimum set of accounts with multi-factor authentication.

Patch Information

SAP addressed the vulnerability as part of the SAP Security Patch Day release. Administrators should review SAP Security Patch Day and apply the fixes described in SAP Note #3558132 to remove the unsafe trace behavior.

Workarounds

Disable the affected debug trace mode in production and restrict trace level changes through change-management workflows.
Tighten filesystem permissions on trace directories so only the SAP runtime user and authorized administrators can read them.
Remove or purge historical trace files that may contain cleartext credentials after credential rotation.

bash

# Reduce SAP Web Dispatcher / ICM trace verbosity to a safe level
# Set in the instance profile, then restart the service
icm/trace_level = 1
wdisp/trace_level = 1

# Restrict access to trace directories
chown -R sapadm:sapsys /usr/sap/<SID>/<INSTANCE>/work
chmod 750 /usr/sap/<SID>/<INSTANCE>/work