PT-2025-28353 · Sap · Sap Netweaver Application Server Abap+1

Published 2025-07-08 · Updated 2025-10-27 · CVE-2025-42956

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform (affected versions not specified)

Description: The issue allows an unauthenticated attacker to create a malicious link that can be made publicly available. When an authenticated victim clicks on this link, the system uses injected input data to create content that, when executed in the victim's browser, has a low impact on confidentiality and integrity, with no effect on the application's availability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-16264

CVE-2025-42956

Affected Products

Abap Platform

Sap Netweaver Application Server Abap

References · 8

• https://bdu.fstec.ru/vul/2025-16264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42956 · Security Note
• https://osv.dev/vulnerability/CVE-2025-42956 · Vendor Advisory
• https://url.sap/sapsecuritypatchday · Patch
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html · Note
• https://t.me/cveNotify/140509 · Telegram Post
• https://twitter.com/CVEnew/status/1942522756047987048 · Twitter Post
• https://me.sap.com/notes/3617131 · Note