CVE-2025-42908

MediumCVSS 5.4/10Last modified Oct 8, 2026

Description

Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-429093.0SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in anCVE-2025-42919.8A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leaCVE-2025-429109.0Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitraCVE-2025-429114.3SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to infCVE-2025-429126.5SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalatioCVE-2025-429133.1Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowleCVE-2025-429143.1Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowleCVE-2025-429155.4Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abusCVE-2025-429168.1Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tableCVE-2025-429176.5SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escCVE-2025-429184.3SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access tCVE-2025-429195.3Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manip