CVE-2025-42893

Description

Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.

PUBLISHED Reserved 2025-04-16 | Published 2025-11-11 | Updated 2025-11-12 | Assigner sap

Problem types

CWE-601: URL Redirection to Untrusted Site

Product status

References

me.sap.com/notes/3662000

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42893)

nvd.nist.gov (CVE-2025-42893)

Download JSON