CVE-2025-42919

MediumCVSS 5.3/10Last modified Oct 18, 2026

Description

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access to sensitive application metadata. This results in a partial compromise of the confidentiality of the information without affecting the integrity or availability of the application server.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server Java	ENGINEAPI 7.50; EP-BASIS 7.50

References

Timeline

Published: Nov 11, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-42925.4A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of t CVE-2025-429206.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a CVE-2025-429216.5In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin CVE-2025-429229.9SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbit CVE-2025-429234.3Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to sen CVE-2025-429246.1SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be red CVE-2025-429254.3Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low CVE-2025-429265.3SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the CVE-2025-429273.4SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of kno CVE-2025-429289.1Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code executi CVE-2025-429298.1Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database table CVE-2025-42935.4A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /ad