PT-2025-28288 · Sap · Sap Netweaver Application Server Abap+1

Published 2025-07-08 · Updated 2025-07-24 · CVE-2025-42969

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform (affected versions not specified)

Description: The issue allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. When a victim clicks on this crafted URL, they unknowingly execute the malicious payload in their browser. On successful exploitation, the attacker can access or modify sensitive information within the scope of the victim's web browser, with no impact on the availability of the application.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-16268

CVE-2025-42969

Affected Products

Abap Platform

Sap Netweaver Application Server Abap

References · 7

• https://bdu.fstec.ru/vul/2025-16268 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42969 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/jmdevlabs/status/1948498737401065755 · Twitter Post
• https://twitter.com/CVEnew/status/1942418291512766589 · Twitter Post
• https://me.sap.com/notes/3596987 · Note