CVE-2025-42981

Description

Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting them to a site controlled by the attacker. This allows the attacker to access and/or modify restricted information related to the web client. While the vulnerability poses no impact on data availability, it presents a considerable risk to confidentiality and integrity.

Reserved 2025-04-16 | Published 2025-07-08 | Updated 2025-07-08 | Assigner sap

Problem types

CWE-601: URL Redirection to Untrusted Site

Product status

Default status
unaffected

SAP_BASIS 700
affected

SAP_BASIS 701
affected

SAP_BASIS 702
affected

SAP_BASIS 731
affected

SAP_BASIS 740
affected

SAP_BASIS 750
affected

SAP_BASIS 751
affected

SAP_BASIS 752
affected

SAP_BASIS 753
affected

SAP_BASIS 754
affected

SAP_BASIS 755
affected

SAP_BASIS 756
affected

SAP_BASIS 757
affected

SAP_BASIS 758
affected

SAP_BASIS 816
affected

References

me.sap.com/notes/3617131

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42981)

nvd.nist.gov (CVE-2025-42981)

Download JSON