CVE-2025-24868

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-248694.3SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server component CVE-2025-24874.9A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when t CVE-2025-248706.0SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to ac CVE-2025-248724.3The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By exe CVE-2025-248746.8SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effectiv CVE-2025-248756.8SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication CVE-2025-248768.1The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an a CVE-2025-24886.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Profelis Informatics SambaBox a CVE-2025-248825.2regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without dete CVE-2025-248838.7go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash us CVE-2025-248845.1kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration wa CVE-2025-248857.6pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control