CVE-2025-42878

HighCVSS 8.2/10Last modified Oct 7, 2026

Description

SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H

Weakness enumeration

CWE-1244

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2025
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-42889.8A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RNFR Command CVE-2025-428809.9Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enableCVE-2025-428824.3Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could exeCVE-2025-428832.7Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with adminiCVE-2025-428846.5SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookCVE-2025-428855.8Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable tCVE-2025-428866.1Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a maliciouCVE-2025-428879.9Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enableCVE-2025-428885.5SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process mCVE-2025-428895.4SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a resuCVE-2025-42899.8A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO CoCVE-2025-4289010.0SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing att