SAP NetWeaver Application Server for ABAP SAP_BASIS 700 up to SAP_BASIS 914 cross site scripting

Summaryinfo

A vulnerability was found in SAP NetWeaver Application Server for ABAP. It has been rated as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-42942. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in SAP NetWeaver Application Server for ABAP and classified as problematic. This issue affects an unknown function. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could access and modify limited information within the scope of victim's browser. This vulnerability has no impact on availability of the application.

It is possible to read the advisory at me.sap.com. The identification of this vulnerability is CVE-2025-42942 since 04/16/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 250286 (SAP NetWeaver AS ABAP Multiple Vulnerabilities (August 2025)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (250286). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• SAP

Name

• NetWeaver Application Server for ABAP

Version

• SAP_BASIS 700
• SAP_BASIS 701
• SAP_BASIS 702
• SAP_BASIS 731
• SAP_BASIS 740
• SAP_BASIS 750
• SAP_BASIS 751
• SAP_BASIS 752
• SAP_BASIS 753
• SAP_BASIS 754
• SAP_BASIS 755
• SAP_BASIS 756
• SAP_BASIS 757
• SAP_BASIS 758
• SAP_BASIS 816
• SAP_BASIS 914
• SAP_BASIS 916

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion