CVE-2025-42990 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.

Reserved 2025-04-16 | Published 2025-06-10 | Updated 2025-06-10 | Assigner sap

LOW: 3.0CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation

Product status

Default status

unaffected

SAP_UI 750

affected

754

affected

755

affected

756

affected

757

affected

758

affected

UI_700 200

affected

References

me.sap.com/notes/3601169

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42990)

nvd.nist.gov (CVE-2025-42990)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-42990

Support options

Helpdesk Chat, Email, Knowledgebase