PT-2025-10677 · Sap · Sap Netweaver Application Server Java

Published 2025-03-11 · Updated 2025-03-11 · CVE-2025-27431

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java (affected versions not specified)

Description The user management functionality is susceptible to Stored Cross-Site Scripting (XSS), allowing an attacker to inject malicious payload. This could lead to information disclosure or unauthorized data modifications within the scope of the victim's browser when the functionality is accessed. There is no impact on availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-03628

CVE-2025-27431

Affected Products

Sap Netweaver Application Server Java

References · 7

• https://bdu.fstec.ru/vul/2025-03628 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27431 · Security Note
• https://me.sap.com/notes/3567246 · Note
• https://t.me/cvetracker/18875 · Telegram Post
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/cvedetector/20008 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html · Note