CVE-2025-42975

Summary

SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a malicious script. When a victim clicks on this link, the script executes in the victim's browser, allowing the attacker to access and/or modify information related to the web client without affecting availability.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)S4COREOP 104affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)105affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)106affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)107affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)108affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)SEM-BW 600affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)602affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)603affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)604affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)605affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)634affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)736affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)746affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)747affected
SAP_SESAP NetWeaver Application Server ABAP (BIC Document)748affected

Weaknesses

  • CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References