CVE-2025-42882

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact on confidentiality, with no impact on the integrity or availability of the application.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-428832.7Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with admini CVE-2025-428846.5SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI look CVE-2025-428855.8Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable t CVE-2025-428866.1Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a maliciou CVE-2025-428879.9Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enable CVE-2025-428885.5SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process m CVE-2025-428895.4SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a resu CVE-2025-42899.8A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Co CVE-2025-4289010.0SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing att CVE-2025-428915.5Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of CVE-2025-428926.8Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent ne CVE-2025-428936.1Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed b