PT-2025-46238 · Sap · Sap Netweaver Application Server Java

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-42919

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java (affected versions not specified)

Description An information disclosure issue exists in SAP NetWeaver Application Server Java. An unauthenticated attacker can access internal metadata files through crafted URLs by including arbitrary path components in requests. This allows unauthorized access to sensitive application metadata, potentially compromising the confidentiality of information. The issue does not affect the integrity or availability of the application server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-14455

CVE-2025-42919

Affected Products

Sap Netweaver Application Server Java

References · 8

• https://bdu.fstec.ru/vul/2025-14455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42919 · Security Note
• https://twitter.com/CVEnew/status/1988077274613383587 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html · Note
• https://me.sap.com/notes/3643603 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/VulmonFeeds/status/1988078521650999443 · Twitter Post
• https://t.me/CVEtracker/36976 · Telegram Post