PT-2025-1183 · Sap · Sap Netweaver As Java

Published 2025-01-14 · Updated 2025-01-14 · CVE-2025-0057

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java (affected versions not specified)

Description The issue is related to a stored cross-site scripting vulnerability. An attacker, posing as an administrator, can upload a photo with malicious JavaScript content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of the victim's web browser. This can be achieved through the User Admin Application. The vulnerability allows for unauthorized data access.

Recommendations As a temporary workaround, consider disabling the photo upload feature in the User Admin Application until a patch is available. Restrict access to the User Admin Application to minimize the risk of exploitation. Avoid using the vulnerable component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-00466

CVE-2025-0057

Affected Products

Sap Netweaver As Java

References · 8

• https://bdu.fstec.ru/vul/2025-00466 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0057 · Security Note
• https://me.sap.com/notes/3514421 · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2025.html · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://twitter.com/CVEnew/status/1878988109192319327 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1879118805764288611 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note