PT-2025-46225 · Sap · Sap Netweaver Enterprise Portal

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-42884

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal (affected versions not specified)

Description An unauthenticated attacker can inject JNDI environment properties or provide a URL during JNDI lookup operations. This could allow access to an unintended JNDI provider, potentially leading to information disclosure or modification on the server. The issue does not impact system availability. The attack involves manipulating JNDI (Java Naming and Directory Interface) lookups, a Java API for discovering data and objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-943

Related Identifiers

BDU:2025-14453

CVE-2025-42884

Affected Products

Sap Netweaver Enterprise Portal

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-42884 · Security Note
• https://bdu.fstec.ru/vul/2025-14453 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html · Note
• https://twitter.com/CVEnew/status/1988077293961703507 · Twitter Post
• https://me.sap.com/notes/3660969 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/CVEtracker/36963 · Telegram Post
• https://t.me/cveNotify/142355 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1988109239030603957 · Twitter Post