SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, injected input data will be used by the web site page generation to create content which when executed in the victim's browser leading to low impact on Confidentiality and Integrity with no effect on Availability of the application.
References
| Link | Resource |
|---|---|
| https://me.sap.com/notes/3617131 | Permissions Required |
| https://url.sap/sapsecuritypatchday | Patch |
Configurations
Configuration 1 (hide)
|
History
27 Oct 2025, 16:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://me.sap.com/notes/3617131 - Permissions Required | |
| References | () https://url.sap/sapsecuritypatchday - Patch | |
| CPE | cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:701:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:731:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:751:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:816:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:750:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:700:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:740:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:* cpe:2.3:a:sap:sap_basis:702:*:*:*:*:*:*:* |
|
| First Time |
Sap
Sap sap Basis |
08 Jul 2025, 16:18
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
08 Jul 2025, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-08 07:15
Updated : 2025-10-27 16:51
NVD link : CVE-2025-42956
Mitre link : CVE-2025-42956
CVE.ORG link : CVE-2025-42956
JSON object : View
Products Affected
sap
- sap_basis
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')