PT-2025-49762 · Sap · Sap Netweaver Enterprise Portal

Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-42872

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal (affected versions not specified)

Description A Cross-Site Scripting (XSS) issue exists in SAP NetWeaver Enterprise Portal. An unauthenticated attacker can inject malicious scripts that run within the context of other users’ browsers. This could allow an attacker to obtain session cookies, tokens, and other sensitive information. The issue has a low impact on confidentiality and integrity, and no impact on availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-489

Related Identifiers

BDU:2025-15896

CVE-2025-42872

Affected Products

Sap Netweaver Enterprise Portal

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-42872 · Security Note
• https://bdu.fstec.ru/vul/2025-15896 · Security Note
• https://twitter.com/CVEnew/status/1998225342742610150 · Twitter Post
• https://me.sap.com/notes/3662622 · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/CVEtracker/39191 · Telegram Post