An SAP Support Tools Plug‑In function module lacks an authorization check. An authenticated user can invoke the module and pull detailed system and configuration data. The vulnerability results in low‑level disclosure of system information, offering attackers intelligence to orchestrate further attacks. The weakness is an improper authorization check (CWE‑862).

The flaw affects the SAP Support Tools Plug‑In offered by SAP SE. Versions impacted include 2008_1_700, 2008_1_710, 740, and 758. Any instance running these versions without the corrective update is susceptible.

The CVSS score of 4.3 indicates moderate severity, but the exploit probability is low (EPSS <1%) and it is not listed in CISA's KEV catalog. Exploitation requires an attacker to have valid SAP credentials and sufficient authorization to call the affected function modules. Once invoked, the attacker can retrieve information that could facilitate more targeted attacks. Because the vulnerability is limited to authenticated users, the risk remains moderate but should be mitigated promptly to prevent information leakage.